> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/balufood.md).

# BaluFood

## BaluFood — Writeup

| Field               | Details    |
| ------------------- | ---------- |
| **Platform**        | DockerLabs |
| **OS**              | Linux      |
| **Difficulty**      | Easy       |
| **Personal Rating** | ⭐⭐☆☆☆      |
| **Date**            | 2026-04-26 |
| **Author**          | Zaiden     |

### Summary

BaluFood is a Linux Docker machine running a Flask-based restaurant web application on port 5000. The admin panel is accessible with default credentials, and the application's source code — readable via a `sysadmin` account whose credentials are hardcoded in the HTML source — leaks the Flask secret key. Using that key as a password attempt against local users yields access to `balulero`. Reviewing `.bash_history` and `.bashrc` reveals a custom alias that contains the root password in plaintext.

**Attack Path:** `Recon` → `Web source code (sysadmin credentials)` → `SSH as sysadmin` → `Flask secret key → su as balulero` → `.bash_history / .bashrc alias → root password` → `Root`

***

### 1. Reconnaissance

#### 1.1 Fast Port Scan

We begin with a fast Nmap scan to identify all open ports:

bash

```bash
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```

**Result:** Ports `22` and `5000` are open.

<figure><img src="/files/mThuYMCj3EZ95JawEGtN" alt=""><figcaption></figcaption></figure>

*Caption: Fast scan revealing open ports 22 (SSH) and 5000 (HTTP)*

***

#### 1.2 Targeted Port Scan

bash

```bash
nmap -sCV -p 22,5000 --min-rate 5000 172.17.0.2
```

**Key findings:**

| Port | Service | Version                        | Notes                       |
| ---- | ------- | ------------------------------ | --------------------------- |
| 22   | SSH     | OpenSSH 9.2p1                  | —                           |
| 5000 | HTTP    | Werkzeug 2.2.2 / Python 3.11.2 | Title: Restaurante Balulero |

<figure><img src="/files/K15ZFS80nAkoQfggS8c5" alt=""><figcaption></figcaption></figure>

*Caption: Service detection — Flask/Werkzeug app running on port 5000*

***

#### 1.3 Web Exploration

Browsing to `http://172.17.0.2:5000` reveals a restaurant website — **Restaurante Balulero** — where users can view a menu and place orders.

*Caption: Restaurant web application — menu and ordering system*

An admin panel is present and accessible with default credentials:

* **Username:** `admin`
* **Password:** `admin`

<figure><img src="/files/v7vFjCJBWz05iLKFzPUy" alt=""><figcaption></figcaption></figure>

*Caption: Admin panel accessible with default credentials admin:admin*

The admin panel appears to be a kitchen-side order management interface — nothing immediately exploitable through normal interaction. Burp Suite interception yielded no useful parameters.

***

#### 1.4 Source Code Review — Hardcoded Credentials

Reviewing the HTML source of the web application reveals hardcoded credentials for a `sysadmin` account:

* **Username:** `sysadmin`
* **Password:** `backup123`

<figure><img src="/files/Rhl4UBedk6OIsoEeqiiN" alt=""><figcaption></figcaption></figure>

*Caption: HTML source leaking sysadmin:backup123 credentials*

***

### 2. Exploitation

#### 2.1 SSH Login as sysadmin

bash

```bash
ssh sysadmin@172.17.0.2
# password: backup123
```

<figure><img src="/files/zmHihA9IWlkWYENPjy3X" alt=""><figcaption></figcaption></figure>

*Caption: Successful SSH login as sysadmin*

***

#### 2.2 Application Source Code — Flask Secret Key

As `sysadmin` we can read the application source:

```bash
cat app.py
```

```python
app.secret_key = 'cuidaditocuidadin'
DATABASE = 'restaurant.db'
```

<figure><img src="/files/xo0kA41gnvbIi6BDXBzm" alt=""><figcaption></figcaption></figure>

*Caption: app.py leaking the Flask secret key: cuidaditocuidadin*

We try `cuidaditocuidadin` as a password against local users found in `/etc/passwd`:

```bash
cat /etc/passwd | grep bash
# root, sysadmin, balulero
```

```bash
su balulero
# password: cuidaditocuidadin
```

<figure><img src="/files/NDR13yeMnsXaS8JoiVt7" alt=""><figcaption></figcaption></figure>

*Caption: Flask secret key reused as balulero's system password*

***

#### 2.3 Proof of Concept

bash

```bash
# 1. Find sysadmin credentials in HTML source
# 2. SSH in as sysadmin
ssh sysadmin@172.17.0.2  # password: backup123
# 3. Read app.py → Flask secret key: cuidaditocuidadin
# 4. Reuse as balulero's password
su balulero  # password: cuidaditocuidadin
```

***

#### 2.4 Loot

| Item             | Value             |
| ---------------- | ----------------- |
| Admin panel      | admin:admin       |
| SSH User         | sysadmin          |
| SSH Password     | backup123         |
| Flask secret key | cuidaditocuidadin |
| Lateral user     | balulero          |

### 3. Privilege Escalation

#### 3.1 Enumeration Checklist

* [x] `sudo -l` → nothing useful
* [x] SUID binaries → nothing non-standard
* [x] `.bash_history` → **revealing commands**
* [x] `.bashrc` → **alias containing root password in plaintext**

bash

```bash
cat ~/.bash_history
```

```
nano ~/.bashrc
apt install nano -y
nano ~/.bashrc
source ~/.bashrc
alias su root
exit
```

bash

```bash
cat ~/.bashrc | grep alias
```

```
alias ser-root='echo chocolate2 | su - root'
```

<figure><img src="/files/PkgXAoS0uTEJLUNHqEfQ" alt=""><figcaption></figcaption></figure>

*Caption: .bash\_history revealing alias usage*

<figure><img src="/files/XEc5RJQZVvvmWhgVDPHL" alt=""><figcaption></figcaption></figure>

*Caption: .bashrc containing a ser-root alias with root password in plaintext*

***

#### 3.2 PrivEsc — Root Password in Alias

The alias `ser-root` pipes `chocolate2` directly into `su - root`, revealing the root password:

bash

```bash
su root
# password: chocolate2
whoami
# root
```

<figure><img src="/files/c2BRUL5yH9Szh3ztZRnc" alt=""><figcaption></figcaption></figure>

*Caption: su root with password chocolate2 — root shell obtained*

***

### 4. Lessons Learned

#### What Worked Well

* Checking the HTML source immediately — credentials were hardcoded in plain sight
* Password reuse between the Flask secret key and a system account was an easy pivot
* `.bash_history` and `.bashrc` are always worth checking during local enumeration

#### Rabbit Holes / What Didn't Work

* Burp Suite interception of admin panel requests yielded nothing exploitable
* The admin panel itself had no obvious attack surface beyond order management

#### New Tools or Techniques Used

* Nothing new on the tooling side — this machine was about thorough manual enumeration

#### Key Takeaway

> Never hardcode credentials in HTML source or application config files accessible to unprivileged users. Password reuse between application secrets and system accounts is a critical misconfiguration. And storing passwords inside shell aliases or history files is the equivalent of writing them on a sticky note on the monitor.

***

### References

* [HackTricks — Linux Local Enumeration](https://book.hacktricks.xyz/linux-hardening/privilege-escalation)
* [Flask Secret Key Security](https://flask.palletsprojects.com/en/3.0.x/config/#SECRET_KEY)

***

*Writeup by Zaiden | 2026-04-26*