> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/allien.md).
# Allien
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
```
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```
**Result: ports 22, 80, 139 and 445 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
```
nmap 172.17.0.2 -p 22, 80, 139, 445 -sS -Pn -sCV
```
We tried to find exploits or shellcodes using **searchsploit** but there wasn't any. Our next step will be directory enumeration. Using our tool **ffuf-dir:**
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:
All those routes are either rabbitholes suggesting potential vulnerabilities or don't have any useful data at all, so we will move to enumerate SMB.
Using `smbmap -H 172.17.0.2` we list the following shares:
Using Cyberchef we can see it's a JWT token, with the following decrypted data:
Using `crackmapexec smb 172.17.0.2 --users` we list the domain users, getting this list:
## 3 - Exploitation
We will do a bruteforce attack to **satriani7** using **rockyou.txt** as wordlist using:
```
crackmapexec smb 172.17.0.2 -u satriani7 -p /usr/share/wordlists/rockyou.txt | grep '[+]'
```
Using those credentials we will login in the share `backup24`:
We find an interesting file, `credentials.txt`:
Using those admin credentials `administrator:Adm1nP4ss2024` we will login into `home` share:
We can see this is the share where the website files are stored, so uploading a reverse shell and navigating to `172.17.0.2/revshell.php` will grant us access to the machine.
We will use the PentestMonkey PHP Reverse shell, and using `penelope` as shell handler, we will have instantly a fully upgraded TTY.
## 4 - Privilege Escalation
After running `sudo -l` we found that user `www-data` has sudo permissions as root on `` /usr/sbin/service` `` . After using a GTFOBins exploit we instantly obtain a root shell:
## 5 - Summary
**Initial Access:**
SMB enumeration revealed a read-only share without authentication, containing a file with an encoded JWT token.
**Exploitation:**
We obtained `satriani7:50cent` credentials via `hydra` attack using `rockyou.txt` as wordlist, obtaining `administrator:Adm1nP4ss2024` credentials.
We uploaded a reverse shell on the SMB share hosting the website content, and querying it we catched the reverse shell via `penelope`
**Privilege Escalation:**
`www-data` user had sudo rights on `/usr/sbin/service` . Using a GTFOBins exploit we obtained a root shell.
