> REPORT: SysAdmins

Executive Summary

SysAdmins is a Medium rated Linux CTF challenge from HackSmarter that demonstrates how OSINT combined with obscure service enumeration can chain into full system compromise. Anonymous FTP access yields a data breach notification containing a defanged URL pointing to a leaked password list. A company website identifies three employees whose names serve as candidate usernames. Standard SSH brute forcing fails, but UDP enumeration reveals SNMPv3 running on the target. Valid SNMPv3 usernames are confirmed via error response analysis, and the leaked passwords are sprayed against the service to recover valid credentials. snmpwalk enumeration of running processes exposes SSH credentials for helena in plaintext. With SSH access established, an outdated sudo binary vulnerable to CVE-2025-32463 is exploited to escalate to root.

Attack Path

Tooling Analysis

The following tools were utilised during this engagement:

1. Enumeration & Reconnaissance

Service Scanning

The engagement began with a comprehensive Nmap scan:

nmap -p- -sV -sC -T4 -oN full_scan.txt 10.1.187.165

The scan identified an FTP server with anonymous access enabled, along with an SSH service.

Anonymous FTP

An anonymous FTP login was performed and the directory contents listed:

ftp anonymous@10.1.187.165

A file named data_breach_notification.txt was present and downloaded with mget *.*:

The file described a data breach and included a defanged URL pointing to a pastebin-hosted password list:

Leaked Password List

Visiting the defanged URL revealed a password list to be used for credential attacks:

Web Application — Employee Enumeration

The hosted website appeared to be a system administration services company. The team page listed three employees, providing candidate usernames:

2. SSH Brute Force & UDP Enumeration

SSH Password Spray

Hydra was used to spray the leaked password list against the SSH service using the employee names as usernames:

hydra -L users.txt -P passwords.txt ssh://10.1.187.165 -t 4 -vV

No valid credentials were found via SSH. With no other TCP services running, UDP ports were scanned:

nmap -sU --top-ports 10 10.1.187.165

SNMP was open on UDP port 161.

3. SNMPv3 Enumeration & Credential Recovery

SNMP Version Fingerprinting

The SNMP version was identified using Nmap scripts:

nmap -sU -p 161 --script snmp-info 10.1.187.165

Standard community strings failed, including the 3000+ entry list from seclists. A more targeted scan confirmed SNMPv3, which does not use community strings:

nmap -sU -p 161 -sV --script snmp-info,snmp-sysdescr 10.1.187.165

Username Validation

SNMPv3 returns different error messages for invalid users versus authentication failures. The employee usernames were tested with snmpget to identify valid accounts:

snmpget -v3 -l noAuthNoPriv -u <username> 10.1.187.165 1.3.6.1.2.1.1.1.0

waserby returned an authentication error rather than a user not found error, confirming it as a valid SNMPv3 username.

Password Brute Force

The leaked password list was filtered to remove entries shorter than 8 characters (SNMPv3’s minimum requirement):

awk 'length >= 8' passwords.txt > passwords_8plus.txt

A bash loop was used to spray the filtered list against the SNMPv3 service, stopping on any response other than an authentication failure:

while read -r pass; do
  result=$(snmpget -v3 -l authNoPriv -u waserby -a MD5 -A "$pass" -t 1 -r 1 10.1.187.165 1.3.6.1.2.1.1.1.0 2>&1)
  if [[ "$result" != *"Authentication failure"* ]]; then
    echo "POSSIBLE HIT ($pass):"
    echo "$result"
  fi
done < passwords_8plus.txt

Valid credentials were recovered for the waserby SNMPv3 account.

snmpwalk Process Enumeration

With valid credentials, snmpwalk was used to enumerate running processes on the host:

snmpwalk -v3 -l authNoPriv -u waserby -a MD5 -A butterfly 10.1.187.165 1.3.6.1.2.1.25

The process list contained plaintext SSH credentials for helena:

4. Initial Access — SSH as helena

The credentials recovered from the snmpwalk output were used to authenticate via SSH:

The user flag was located in helena’s home directory:

5. Privilege Escalation — CVE-2025-32463

Vulnerable sudo Binary

After exhausting standard escalation paths, the version of installed binaries was checked. The sudo binary was found to be running a version vulnerable to CVE-2025-32463:

A public exploit is available at https://github.com/pr0v3rbs/CVE-2025-32463_chwoot.

Exploitation

The sudo-chwoot.sh exploit script was copied to the target machine, made executable, and run with bash:

A root shell was obtained. The root flag was retrieved from /root/root.txt:

Vulnerability Mapping (CWE)

Remediation & Mitigation Strategies

1. Disable Anonymous FTP and Restrict Sensitive File Storage (NIST AC-3, CIS Control 3.3)

• Mitigation: Anonymous FTP access must be disabled on all production systems. Where FTP is required, enforce authenticated access with least-privilege accounts and restrict accessible directories to only those necessary. Sensitive documents such as data breach notifications must never be stored in publicly accessible locations — distribute these through authenticated, encrypted channels only.

2. Restrict SNMP Access and Enforce Strong SNMPv3 Authentication (NIST IA-2, CIS Control 4.2)

• Mitigation: SNMP should be restricted to trusted management network segments via firewall rules, preventing external access to UDP port 161. SNMPv3 must be configured with strong, unique passphrases of sufficient length and complexity to resist brute force. Implement account lockout or rate limiting on authentication attempts where the SNMP implementation supports it, and audit SNMP access logs regularly for unusual query patterns.

3. Prevent Credential Exposure in SNMP Process Data (NIST IA-5, CIS Control 3.11)

• Mitigation: Processes that require credentials should never pass them as command-line arguments, as these are visible to all users via process listing tools and SNMP MIBs. Use environment variables, configuration files with restricted permissions, or secrets management solutions to supply credentials to running processes. Audit running processes periodically to identify credential exposure in process arguments.

4. Apply Security Patches Promptly — sudo and System Binaries (NIST SI-2, CIS Control 7.6)

• Mitigation: Critical system binaries such as sudo must be kept up to date with security patches applied as soon as they are available, particularly for vulnerabilities with public exploits. Implement a patch management process with defined SLAs for critical severity vulnerabilities. Use vulnerability scanning tools to identify outdated or unpatched binaries across all managed systems, and prioritise remediation based on exploitability and exposure.