CyberSploit1 (OffSec Proving Grounds)

CyberSploit1 is a very small, focused machine: a Base64‑encoded hint in /robots.txt reveals SSH credentials, and privilege escalation is achieved via a known local kernel exploit.

Overview

Target: CyberSploit1
Initial vector: /robots.txt → Base64 → SSH
Privilege escalation: local kernel exploit (37292)

Enumeration

Directory fuzzing reveals /robots:

Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=

Decode it:

$ echo 'Y3liZXJzcGxvaXR7eW91dHViZS5jb20vYy9jeWJlcnNwbG9pdH0=' | base64 -d
cybersploit{youtube.com/c/cybersploit}

Use it as the SSH password for user itsskv.

Foothold

$ ssh itsskv@192.168.234.92
Password: cybersploit{youtube.com/c/cybersploit}
$ id; whoami

Privilege Escalation

Check kernel:

$ uname -a

The kernel is vulnerable to exploit 37292:

https://www.exploit-db.com/exploits/37292

Download, compile, and run the exploit from /tmp to obtain a root shell.