Sunset : 1

1. Introduction

Sunset: 1 is a beginner-to-intermediate boot2root virtual machine from VulnHub, designed to test enumeration, web/service exploitation, and privilege escalation skills. The goal is straightforward: gain initial access to the machine and escalate privileges to root to capture the final flag.

For this walkthrough, I set up the VM in [VirtualBox] on a NAT network alongside my Kali Linux attacker machine at 10.0.2.22 .

2. Reconnaissance

I started by identifying the target's IP address on the network using sudo arp-scan -l , since the VM doesn't announce itself with a static IP. This returned 10.0.2.3 as the live host alongside my own machine.

sudo arp-scan -l

With the IP identified, I ran a full TCP port scan using Nmap with service and version detection to get a clear picture of the attack surface:

nmap -sSCV <machine_ip>

The scan revealed 2 open ports: [list them, e.g., 21 (ftp), 22 (ssh)]. Right away, [the ftp / ssh] stood out as the most promising entry point, since [reason — e.g., anonymous login was allowed]

3 . FTP Enumeration

With only FTP and SSH exposed, FTP is the obvious first stop. Anonymous login is worth testing on every box:

ftp <machine_ip>

We got into the ftp service using the credentials anonymous:anonymous.

Now , We have got into the anonymous login in the machine, so it's time to check for any useful data.

ls

We check for files in the current working directory. As we are able to see that there is a readable text file called 'backup'.

get backup

By using 'get backup' , we get the backup file into our attack machine and now we can come out of ftp service using the 'exit' command.

exit

Now it's time to check what is contained in the file that we obtained from ftp service.

cat backup

As we are able to see that the file contain some user name and it's hash. As we are working in the sunset machine, the credentials for sunset is crucial for us. So copy the sunset credentials along with the hash and save it in a text file (in our case we have created backup.txt).

Inspecting backup locally shows it's not a config file or archive — it's a shadow-style password hash for the user sunset. Save it to its own file and hand it to John the Ripper against rockyou.txt:

john — wordlist=/usr/share/wordlists/rockyou.txt backup.txt

After execution of the john the ripper tool we obtain the password as 'cheer14' . So this is the password for the ssh login sunset:cheer14 .

5. Initial Access via SSH

With a username and plaintext password in hand, sshis the natural next step:

Now we have got into the ssh service, now we have a shell and we need to check for any useful information (i.e flag).

ls

Now after looking for the file within the present working directory, we are able to see the user.txt file (i.e the first flag ).

Now we have seen the data within the file called user.txt.

Now it's time for the most interesting part of all ……

6.Privilege Escalation Enumeration

Standard first move on any fresh shell — check what the user can run as root:

sudo -l

The output shows sunset is permitted to run /usr/bin/ed as root with no password required. ed is a classic line-based text editor — and critically, it supports shelling out to the underlying OS from within its own prompt, which makes it a well-known privilege escalation vector (it's listed on GTFOBins for exactly this reason).

7.Exploiting ed for Root

sudo ed

From inside the ed prompt, escape to a shell using its ! command, which executes the following text as a system command

!/bin/sh

After the execution of shebang, the next line we appear with a '#' , which signifies the root and for the confirmation we run the command 'whoami'

As the shell return the with 'root'.

after this step we move to the root directory to get final file (i.e flag.txt)

cd /root

8.Capturing the Flag

With root secured, grab the final flag

cat flag.txt

Conclusion

Sunset: 1 is a clean, short chain that rewards good habits rather than exotic exploitation: always test anonymous FTP, always try cracking any hash you find before assuming it's a dead end, and always run sudo -l as soon as you land a shell. The ed sudo misconfiguration is a good reminder that privilege escalation isn't limited to obvious binaries like bash or vim — any interactive program with a shell-escape feature is fair game, and GTFOBins is worth checking for literally anything that shows up in sudo -l.