> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/extraviado.md).
# Extraviado
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 22 and 80 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`
We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:
```
ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt }
```
we ran `ffuf-dir http://172.17.0.2/FUZZ` and we just found `/index.html` so we will browse it.
We found an Apache2 default page, but we found those 2 base64 encoded strings:
After decoding them we get the following credentials: `daniela:focaroja`, so we will log in through SSH with them.
## 3 - Privilege Escalation
We can find in `/home` a folder named `.secreto` containing the following:
Trying to login as diego using `diego:YmFsbGVuYW5lZ3Jh` won't work, so we pass it through cyberchef, revealing it's Base64 again. The plaintext credentials are `diego:ballenanegra`.
At diego's `/home` we found again a folder named `.passroot` containing the following:
Sadly, after decoding it from Base64 we find it says `acatampocoesta`, meaning the password is not there. As this machine is hiding lots of files, we ran `find / -name ".*" 2>/dev/null` finding this:
After asking ChatGPT to solve this riddle, it came out with the password `osoazul`.