Jangow: 1.0.1 — VulnHub Walkthrough

A beginner-friendly box that chains Local File Inclusion, leaked FTP credentials, and a kernel exploit to get from nothing to root.

By hackwithkevin_

Introduction

Jangow: 1.0.1 is a beginner-level boot2root machine from VulnHub. It’s a good box for practicing enumeration discipline — nearly every step depends on carefully reading what the previous step gave you, rather than on any single “flashy” exploit. In this walkthrough I’ll cover how I went from an unauthenticated web app to a root shell.

Download: https://download.vulnhub.com/jangow/jangow-01-1.0.1.ova Difficulty: Easy

Reconnaissance

I started by finding the target on the network:

sudo netdiscover -i eth0

Next, a service scan to see what’s exposed:

nmap -sC -sV 192.168.56.118

Results:

• Port 21 (FTP) — open
• Port 80 (HTTP) — open

Two open ports, but a lot of potential attack surface: FTP suggests credentials might eventually be useful, and HTTP means there’s a web app worth digging into.

Web Enumeration

I found a site/ folder to explore.

We are redirected to the broken link page by the URL. We have discovered that the machine has directory listing enabled. One folder with the name site/ was located in the current directory.

Inside, I found a simple “Grayscale” template site with one interesting feature: a search box labelled “buscar” (Spanish for “search”) in the top-right corner. It submitted a POST request to a PHP script — a strong hint that user input was being passed somewhere unsafely.

Let’s see what we can do with this LFI vulnerability. Let’s type ls -al command to list out the files and directories.

see the url that i keep some input [ls -al]

We were able to identify a WordPress directory from the output. We discovered that this page is broken after visiting the WordPress page.

This could be occurring as a result of WordPress losing access to the database or the database being erased. Returning to the buscar tab, let’s see if any other files exist that might help in establishing an FTP connection.

Although the result indicates the existence of a config.php file, it appears to be something else. Let’s use the cat command to open the file and read the contents.

We can see the username and password in the output. With their assistance, let’s attempt an FTP connection.

It is evident that the attempt to log in was unsuccessful, indicating that WordPress is experiencing difficulties accessing the database. Now let’s see the current working path .

Now let’s enumerate every hidden file and directory that could exist in /var/www/html.

ls -al /var/www/html

The report indicates the presence of a .backup file, which appears to contain backup database credentials. Let’s use cat command to read the file.

cat /var/www/html/.backup

Let’s try connecting to the server with the FTP client tool once more. We were able to successfully log in.

The user file is located under the jangow01 directory. To see a list of files and directories, use ls. Let’s use get from ftp to download the file.

ls

cd /home

ls

cd jangow01

ls

get user.txt

Let’s read user.txt’s content now.

We now need to figure out how to elevate user jangow01’s privileges to that of super admin. Reverse shell is one method to see if it is achievable or not.

Get Hackwithkevin’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Let’s

Method : Using Netcat

The netcat command also makes it possible to establish a reverse connection.

nc 192.168.56.118 21

user jangow01

pass abygurl69

help

To log in, enter your password and username. However, with this, the reverse shell connection is likewise unavailable.

Privilege Escalation

To obtain the maximum privilege in the system, the next step is to escalate to the root user. Navigate back to the jangow01 directory and make a list of all the hidden folders and files.

We will use a program called Linpeas for privilege escalation, which can automate a significant portion of the target system’s enumeration procedure..

• Download link: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS

It is now necessary to use the FTP service to move it to the destination system.

ls

cd /home/jangow01

put linpeas.sh

We can verify it on target machine.

Give it permission to be executed, then carry it out.

Conclusion

Jangow: 1.0.1 is a solid example of how small misconfigurations compound into full compromise:

1. An LFI vulnerability in a search feature exposed the filesystem.
2. A leftover .backup file leaked valid FTP credentials.
3. A missing write-permission check stopped the “obvious” PHP reverse shell, but a simple bash one-liner through the same LFI got the job done anyway.
4. An outdated kernel made privilege escalation almost automatic once LinPEAS pointed at it.

Takeaways for defenders:

• Never leave .backup, .old, or similar files in a web root.
• Sanitize and whitelist any user input used in file-path operations to prevent LFI.
• Keep kernels patched — CVE-2017–16995 is years old and still shows up on easy boxes because it’s such a reliable privesc.

Thanks for reading — happy hacking! If you found this useful, follow for more VulnHub and CTF writeups.

📲 Follow @hackwithkevin_ on Instagram for more hacking walkthroughs and cybersecurity resources.

Tools used: netdiscover, nmap, ftp, netcat, LinPEAS, gcc

About the author I’m Kevin — I post CTF walkthroughs and hacking content as @hackwithkevin_ on Instagram. Follow along for more writeups like this one.