> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/escolares.md). # Escolares ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p ports -sS -Pn -sCV`

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

Accessing /wordpress end up on a broken website, so we couldn't get anything useful from there. Also we saw it's pulling data from escolares.dl, so we add it to /etc/hosts. We will try to get any information hidden in comments on HTML source code using: ``` curl -s http://172.17.0.2 | sed -n '//p' ```

Accessing it will show us a list of teachers, being Luis the most relevant for us, as it's the wordpress admin:

## 3 - Exploitation We first tried to run rockyou.txt on it, but after not getting the password, we decided to create a password list with `cupp -i`. Inputting all the info we have about Luis, it exported a `luis.txt`. Knowing his email is , we did: ``` wpscan --url escolares.dl/wordpress -U luisillo -P luis.txt ``` We hit the password, `luisillo:Luis1981`. Now that we have full access to the Wordpress admin panel, all we have to do is upload a reverse shell from PentestMonkey and browsing it to activate it. We will upgrade the reverse shell to a fully interactive shell using Python. First we will run `which python python2 python3` to know the version that the server is running. After it, we see that the server is running python3, so we execute this command: ``` python3 -c 'import pty;pty.spawn("/bin/bash")'; ``` Now we will send temporarily our shell to the background with `CTRL+Z` and we will run: `stty raw -echo;stty size;fg` That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this: `export SHELL=kitty stty rows 46 columns 207 export TERM=xterm-256color` Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one.

Analyzing both will give us `luisillopasswordsecret` and a Base64 encoded hash that will give us `premiumpassword`. We will read /etc/passwd to try to find an user to login with that password. ## 4 - Privilege Escalation We found the user `luisillo`, and `luisillopasswordsecret` logs us in. He has sudo permissions as root on `/usr/bin/awk`, and with a GTFOBins oneliner we got a root shell: ``` sudo awk 'BEGIN {system("/bin/sh")}' ```

## 5 - Summary **Initial Access:**\ Website enumeration revealed user `luisillo`. A custom password list generated with cupp and used with wpscan cracked the WordPress admin credentials (`luisillo:Luis1981`). **Exploitation:**\ Uploaded a PHP reverse shell via the WordPress admin panel, gained a shell, and discovered additional credentials (`luisillopasswordsecret` and `premiumpassword`). Logged in as `luisillo`. **Privilege Escalation:**\ `luisillo` had sudo permissions on `/usr/bin/awk`. Abusing GTFOBins, we spawned a root shell.