> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/aguademayo.md).

# AguaDeMayo

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

<figure><img src="/files/LRTJLVDW4GGjJd330gtq" alt=""><figcaption><p>(AguaDeMayo) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but nothing was found. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
	ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found /images, we will keep an eye of it. /index.html is a default Apache2 site, so we browsed /images and found `agua_ssh`, meaning it could be a private SSH key hidden with stego.

<figure><img src="/files/sqgLxLPeCuKpZevUYa1y" alt=""><figcaption><p>(AguaDeMayo) Agua_SSH</p></figcaption></figure>

After analyzing it with multiple stego tools, we found there is no useful information inside, so we continue analyzing the website. Using the following grep, we will find all the comments on HTML source code:

```
curl -s http://172.17.0.2 | sed -n '/<!--/,/-->/p'
```

## 3 - Exploitation

We found a string, that is encoded with BrainFuck language, we know this asking ChatGPT.

<figure><img src="/files/qju9bAURv2UqK313PY35" alt=""><figcaption><p>(AguaDeMayo) BrainFuck String</p></figcaption></figure>

After analyzing it with a BrainFuck interpreter, we got the following string: `bebeaguaqueessano`. Knowing the file was `agua_ssh` we will try to login as `agua` with that password.

## 4 - Privilege Escalation

After running `sudo -l` we found that user `agua` has sudo permissions as root on `/usr/bin/bettercap`. After researching a little bit, we found that using ! as prefix let us run system commands. Knowing that, we will set SUID on /bin/bash so we can have a more stable terminal.

<figure><img src="/files/6i37Js6wZfUY6obG4mCK" alt=""><figcaption><p>(AguaDeMayo) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Directory enumeration revealed `/images/agua_ssh` and source code comments contained a BrainFuck string. Decoding it yielded the password `bebeaguaqueessano`, which allowed SSH access as `agua`.

**Privilege Escalation:**\
The `agua` user had sudo rights on `/usr/bin/bettercap`. Using the `!` command execution feature, we set SUID on `/bin/bash` and obtained a root shell.