> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/buscalove.md).

# BuscaLove

### 1 - Reconnaissance <a href="#id-1-reconnaissance" id="id-1-reconnaissance"></a>

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 22 and 80 are open**

### &#x20;<a href="#id-2-enumeration" id="id-2-enumeration"></a>

### 2 - Enumeration <a href="#id-2-enumeration" id="id-2-enumeration"></a>

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

**Result:**

<figure><img src="/files/phxOaF8jcak6KZDqkMrY" alt=""><figcaption><p>(BuscaLove) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit Apache httpd 2.4.58` and `searchsploit OpenSSH 9.6p1` but there wasn't any. Our next step will be directory enumeration.&#x20;

With the command f`fuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://172.17.0.2/FUZZ -e .html,.php` we found a /wordpress directory.&#x20;

<figure><img src="/files/f2sNHuyVVzjGwVW0l52I" alt=""><figcaption><p>(BuscaLove) FFUF results</p></figcaption></figure>

We tried to explore /wordpress, but there wasn't anything useful, so we will perform discovery again under it.

<figure><img src="/files/HDgRuehQDyErjr2aYY5v" alt=""><figcaption><p>(BuscaLove) Index.php</p></figcaption></figure>

### 3 - Exploitation <a href="#id-3-exploitation" id="id-3-exploitation"></a>

Knowing it's an index.php, and we don't have anything else to work with, we will try parameter fuzzing, to try LFI. Using:

`ffuf -w /path/to/wordlist/burp-parameter-names -u http://172.17.0.2/wordpress/index.php/?FUZZ=/etc/passwd`

we found nothing, but it's the only potential way in, so knowing the machine is called BuscaLove (search love in english), we tried with the parameters BuscaLove and Love.&#x20;

<figure><img src="/files/yYeDa6XWIsSRE1lbJbQu" alt=""><figcaption><p>(BuscaLove) /etc/passwd exposed via LFI</p></figcaption></figure>

With this, we exposed 2 potential users to access the system, pedro and rosa. Using hydra we cracked rosa's password:<br>

<figure><img src="/files/KQnByHXurJUU138V4gO8" alt=""><figcaption><p>(BuscaLove) Rosa's password</p></figcaption></figure>

After running sudo -l, we know we can run ls and cat as root. Using cat, we read /etc/shadow

<figure><img src="/files/kF05MBPUiq6I7Xur5ynk" alt=""><figcaption><p>(BuscaLove) /etc/shadow</p></figcaption></figure>

After breaking it with john, we found the password kittycat.

### 4- Summary

**Initial Access:**\
Nmap and directory enumeration revealed a WordPress instance. Parameter fuzzing on `index.php` exposed system users. Hydra was used to crack `rosa`’s password for SSH access.

**Exploitation:**\
Authenticated as `rosa`, enumeration showed `sudo` privileges on `ls` and `cat`.

**Privilege Escalation:**\
Using `cat` with sudo, we read `/etc/shadow`, cracked root’s hash with John, and obtained the password `kittycat`.