> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/consolelog.md).
# ConsoleLog
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
```
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```
**Result: ports 80, 3000 and 5000 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
```
nmap 172.17.0.2 -p 22,3000,5000 -sS -Pn -sCV
```
We tried to find exploits or shellcodes but there wasn't any. Our next step will be directory enumeration. Using our tool **ffuf-dir:**
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we did `ffuf-dir http://172.17.0.2/FUZZ` we found the following routes:
And after browsing /**backend** we found `server.js` containing the javascript for the website:
## 3 - Exploitation
We did an `hydra` attack trying to get the username for the password we got, `lapassworddebackupmaschingonadetodas` but we didn't find any. Anyways, as it's a common situation for some DockerLabs environment, we decided to try with `rockyou.txt:`
After that, we can access via SSH to `lovely:lapassworddebackupmaschingonadetodas`
## 4 - Privilege Escalation
After running `sudo -l` we found that user `www-data` has sudo permissions as root on `/usr/bin/nano`. After using a GTFOBins exploit we obtained a root shell:
## 5 - Summary
**Initial Access:**
Obtained plaintext password for an unknown user via a exposed route, `/backend/server.js`.
**Exploitation:**
Performed an `hydra` attack using `rockyou.txt` as user wordlist, obtaining the user `lovely`.
**Privilege Escalation:**
Obtained a root shell abusing sudo permissions on `/usr/bin/nano` as `root` via user `lovely` , using a GTFOBins exploit.