HOW TO COMPLETE SUNSET:1 CTF CHALLENGE

sunset:1 CTF Walkthrough

Introduction

Sunset: 1 is a beginner-friendly Capture The Flag (CTF) machine from VulnHub, designed to help learners practice basic penetration testing techniques. The challenge focuses on enumeration, web exploitation, and Linux privilege escalation through common misconfigurations. The objective is to gain root access and capture the final flag in a safe lab environment.

Objective

The objective of the Sunset: 1 VulnHub CTF machine is to identify vulnerabilities through proper enumeration, gain initial access to the system, and ultimately escalate privileges to obtain root access. Successfully capturing the final flag demonstrates complete compromise of the target machine.

Step 1

Set the NAT network and configure both machines (Kali and Sunset) to be on the same network.

Step 2

The first step of reconnaissance was using the command “arp-scan -l” which revealed the IP address of the target machine.

arp-scan -l

Step 3

After finding the IP address, I performed an Nmap scan to identify open ports and potential vulnerabilities. Different flags were used to gather more detailed information. The command used was “nmap -sV -sC -Pn -T4 10.0.2.5” which produced the following results.

nmap -sV -sC -Pn -T4 10.0.2.5

Based on the scan results, anonymous FTP login was found to be enabled.

Step 4

An FTP connection was made, and I logged in using anonymous credentials (Username: anonymous, Password: anonymous). I then listed the contents of the current directory using the “ls” command.”

ftp 10.0.2.5
ls

After discovering a file named ‘backup’, I transferred it to the Kali machine and displayed its contents using the “cat” command.

get backup
exit
ls
cat backup

Found the password hash. Next, the hash was copied and saved to a file named ‘crack’ using the “nano” command.

nano crack

Step 5

Now, we are going to crack the hash using the tool John the Ripper with the default wordlist available in Kali Linux, located at “/usr/share/wordlists/rockyou.txt”

Get Bibin’s stories in your inbox
Join Medium for free to get updates from this writer.
Remember me for faster sign in
john --wordlist=/usr/share/wordlists/rockyou.txt crack

found it as “cheer14”.

Step 6

Next, we attempted to log in via SSH using the obtained password. The command used to establish the SSH connection was
“ ssh sunset@10.0.2.5”, where sunset is the username and 10.0.2.5 is the host IP. Using this method, we successfully logged in to the Sunset machine as a normal user.

ssh sunset@10.0.2.5

Step 7

After listing the contents of the current directory, we found a file named ‘user.txt’. Viewing it with the “cat” command revealed the first flag.

ls
cat user.txt

Step 8

For the root flag, we’ll change the directory to “/”

cd /

Now we’ll “ls” command and go to the ‘root’ directory

ls
cd root

We can see we don’t have permission to access the root folder. So to check who has root or sudo privileges we’ll type
“sudo -l”.

sudo -l

Here, ed has root privileges without a password. So we’ll go to GTFObins and search for ed, then copy the command for sudo privileges.

ed | GTFOBins

sudo ed
!/bin/sh

As you can see, we are now root users. We can access the root folder and disclose the root flag.

ls
cd root
ls
cat flag.txt

And that’s how we completed the sunset:1 CTF.