Sunset: 1 Walkthrough -Vulnhub

"Sunset" created by the skilled author "Whitecr0wz," is a beginner-level Capture The Flag machine. The main objective is to discover the hidden flags and gain root access to the target system. It provides an excellent learning experience for beginners who want to understand the basics of cybersecurity and ethical hacking.

To begin, we use tools like Nmap to scan and analyze the target network. This helps us identify the available services, open ports, and the devices connected to the network.

1. ifconfig

ifconfig is a command used to see and manage your computer's network settings, like its IP address and network connection. It helps you check if your computer is connected to a network.

2. nmap 10.0.2.0/24

it is used to scan all devices on the 10.0.2.0/24 network and helps find active computers and identify which hosts are online within that network range. we can see target ip and the open ports which are ssh and ftp

3. nmap -p- -A 10.0.2.4

This command scans all ports on the target IP address and tries to gather detailed information, such as the operating system, running services, versions, and other useful details about the target.

From the scan results, we can observe that "Anonymous FTP login allowed" is enabled, and there is also a backup file available. Since anonymous login is permitted, we can access the FTP server and view the contents of the backup file.

4. ftp < Target IP>

ftp 10.0.2.4

ls : listing the files

get backup : to download the file from ftp server to your system

exit

After downloading the backup file, we can examine its contents using the command cat backup.

The backup file contains the Sunset hash. Create a new text file by copying the hash into it. You can use the command nano password(or any filename) and paste the hash inside. Once the hash is saved, we can use John the Ripper

5. john password

Success! We have successfully recovered the login password for the Sunset user. So the password for User "sunset" is "cheer14". We'll use this username and password for ssh login.

6. ssh sunset@

Now we can log in to the target machine through SSH using the credentials we obtained. The username is sunset, and the password is cheer14, which was cracked using John.

7. cat user.txt

ls

cat user.txt

Great! We have successfully captured the first flag.

Next, we need to identify which binary has sudo privileges. After checking the sudo permissions, we find that ed is listed in the sudoers configuration.

8. sudo ed

sudo ed

! /bin/sh

whoami

cd /root

ls

cat flag.txt

Successfully! We have also obtained the second flag.