One Buffer Overflow, One Misconfigured Sudo Rule: Breaking Into HarryPotter Fawkes

Not every penetration test requires a complicated exploit chain.

Sometimes, one vulnerable service is enough to get a foothold. A poorly configured privilege system can then turn that foothold into complete control.

That was the story behind HarryPotter: Fawkes, an intentionally vulnerable machine from VulnHub.

1. Finding the Attack Surface

I started with Nmap reconnaissance and identified five open TCP ports:

• 21 — FTP
• 22 — SSH
• 80 — HTTP
• 2222 — SSH
• 9898 — Custom TCP service

The FTP service allowed anonymous access. More interestingly, it exposed an executable named server_hogwarts.

I downloaded the binary and began examining it.

2. A Vulnerable Service Behind Port 9898

The custom application on port 9898 accepted user input without proper bounds checking.

Static and dynamic analysis revealed a stack-based buffer overflow caused by an unsafe strcpy() operation.

The return address could be overwritten after 112 bytes of padding. The executable also lacked important protections, including NX and PIE.

After validating the offset and identifying a suitable jmp esp instruction, I developed a proof-of-concept exploit.

The exploit successfully opened a reverse shell as the user harry.

3. From Harry to Root

Initial access was only the beginning.

During post-exploitation enumeration, I discovered that harry had unrestricted passwordless sudo privileges.

That configuration allowed the account to execute commands with root privileges without authentication.

I used this misconfiguration to obtain a root shell and recover the first Horcrux.

A single application vulnerability had provided initial access; a separate privilege-management failure turned it into full system compromise.

4. FTP Traffic Revealed Another Account

A note discovered in the root directory pointed toward a user who had mistakenly entered credentials into the FTP service.

I captured FTP traffic using tcpdump.

Because FTP transmitted its control-channel data in plaintext, the username and password were visible in the captured traffic — even though the FTP login itself had failed.

The recovered credentials also worked against SSH, providing access to the user neville.

This led to the recovery of the second Horcrux.

5. The Exploit That Didn't Work

From Neville's session, I discovered a custom SUID-enabled sudo binary reporting version 1.8.27.

I investigated it as a potential candidate for CVE-2021–3156, also known as Baron Samedit.

A public proof of concept was tested, but its internal vulnerability check reported:

AssertionError: target is patched

No privilege escalation was achieved through this attempt, and the third Horcrux remained unrecovered.

Recording unsuccessful exploitation attempts is just as important as documenting successful ones.

Final Thoughts

The Fawkes assessment demonstrated how multiple weaknesses can combine into a serious compromise:

• Anonymous FTP exposed an executable.
• A stack-based buffer overflow provided remote initial access.
• Unrestricted passwordless sudo enabled root access.
• Unencrypted FTP traffic exposed credentials that worked against SSH.
• A separate privilege escalation attempt was unsuccessful and documented honestly.

Two of the three Horcruxes were recovered, and full root access was achieved in Harry's environment.

The biggest lesson?

A vulnerability may open the door, but poor security configuration can leave the entire system exposed.

This assessment was conducted against an intentionally vulnerable VulnHub virtual machine in an isolated lab environment for educational purposes.

Further reading: CVE-2021–3156 — Baron Samedit · VulnHub