Vulnix Solution

Vulnix is not a vulnerable software version, it is a vulnerable Linux host with configuration weaknesses. You can use this guide to solve the Vulnix challenge.
You can get the Vulnix from here:https://www.vulnhub.com/entry/hacklab-vulnix,48/

Finding victim machine’s (Vulnix VM) IP address.

root@hacktivism:~# netdiscover -r 192.168.1.0/24

**If you are not familiar with netdiscover , just follow this guide: http://hacktivismbycs.blogspot.com/2017/07/scan-live-hosts-on-network.html

A port scan on the victim host.

root@hacktivism:~# nmap -sT -p- -Pn -n -v 192.168.10.96 -T5

Finding users of the victim host.

root@hacktivism:~# smtp-user-enum -M VRFY -U /usr/share/metasploit-framework/data/wordlists/unix_users.txt -t 192.168.10.96

Running finger against the usernames we found.

Since we have NFS service running on port 2049, we may be able to mount a share and find some data.

The mounted share cannot be accessed because the root_squash flag is set.

Brute forcing SSH to find the password for the account named “user”.

After that, we could gain the access of the account user over SSH.

Finding UID of user account called vulnix and create a temporary user on our system.

Generate an SSH key to log into the server as user vulnix without a password.

We have to copy the generated ssh-key into the /home/vulnix/.ssh/authorized_keys file.

Login to the victim's machine as ‘vulnix’.

Vulnix can run a command to open /etc/exports without typing a password.

Then we have to replace the root_squash flag with no_root_squash. Then reboot it manually.

Once the machine has rebooted, mount the partition again.

Once mounted, get a copy of the victim’s machine local shell and change the ownership and SID to the root one.

On my local machine, as ‘root’:

On the victim's machine:

And finally, we can get the root access on the victim machine.

~CS