> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/grooti.md). # Grooti ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22, 80 and 3306 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 22,80,3306 -sS -Pn -sCV`

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

Accessing /imagenes will show us a README.txt containing this:

Accessing /secret will show this:

Inside of the instructions file there is a command to connect to the database: ``` mysql -u rocket -p -h 172.17.0.2 --ssl=0 ``` Using `password1` we're inside the database. ## 3 - Exploitation Running the following commands will show the content of the table `rutas` containing useful information: ``` SHOW DATABASES; USE FILES_SECRET; SHOW TABLES; SELECT * FROM RUTAS; ```

Browsing /unprivate/secret will show us this login:

We did a first try inputting `test` and `1` and it downloaded a `password1.txt` containing "Buen intento!". There wasn't any reference to the first field, so we will just focus on the number. We will open Burpsuite, and send the petition to Intruder, trying to fuzz the value from 1 to 100. For that we will run `seq 1 100 > fuzzing.txt` and load it as a payload. We will setup the number as a variable to fuzz, and run a Sniper Attack:

As we can see, 16 has a length much bigger than the other ones, so we think we hit the correct one. Trying to input `test:16` on the login panel will give us a .zip, containing `password16.txt` but it's locked. After running the following commands, we got a short wordlist of passwords, probably to bruteforce into the machine: ``` zip2john password16.zip > hash john --wordlist=/usr/share/wordlists/rockyou.txt hash unzip password16.zip password1 ``` We know there were 3 users on the database, as we could see on /secret, they are `grooti`, `rocket` and `naia`. Trying to Hydra into them with that wordlists will grant us the `grooti` credentials:

## 4 - Privilege Escalation We ran `sudo -l` and `find / -perm -4000 2>/dev/null` trying to find any sudo capabilities or SUID, but there wasn't any. Also, we ran `find / -type f -name "*.txt" 2>/dev/null` trying to find any exposed credentials on txt files, but we didn't find anything either. Before running LinPeas, we checked crontab, to find `/opt/cleanup.sh`.

We can see it's calling a second script, and we don't have write permissions on `/opt/cleanup.sh` but we have on `/tmp/malicious.sh`, so we will modify it to gain a root shell, since the first one is running as `root`. All we have to do is open `/tmp/malicious.sh` with nano and edit it:

Now, we just have to wait until the original script is activated, and we will have SUID on `/bin/bash`.

## 5 - Summary **Initial Access:**\ Directory enumeration revealed `/imagenes` and `/secret`, which exposed MySQL credentials (`rocket:password1`). Database inspection revealed users and routes. A hidden login in `/unprivate/secret` was fuzzed, yielding a protected ZIP. Cracking it with `zip2john` and John provided a custom password list, which allowed SSH access as `grooti`. **Exploitation:**\ Exploited the login panel with fuzzing and used the extracted wordlist from the cracked ZIP to brute-force `grooti`’s SSH credentials. **Privilege Escalation:**\ Found a root-owned cron job `/opt/cleanup.sh` that executed `/tmp/malicious.sh` with write permissions. By editing the script to set SUID on `/bin/bash`, we obtained a root shell.