> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/internal.md).
# Internal
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 22 and 80 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 21,80 -sS -Pn -sCV`
As we can see, it tries to redirect to `http://internal.dl` so we will add this domain to our `/etc/hosts:`
We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-vhost`:
```
ffuf-vhost () {
ffuf -H "Host: FUZZ.$1" -u http://$1 -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt ${@: 2}
}
```
we did `ffuf-dir internal.dl` and we found the following subdomains, so we add it also to `/etc/hosts`:
Browsing `internal.dl` gives us little to no information, but `backup.internal.dl` give us a potential attack vector:
As we can see, there is a field where we input a path, and the server is executing a `ls -lah:`
## 3 - Exploitation
Trying to do `/etc/passwd | echo "test"` and many other operators get blacklisted, so we start trying all the potential ways to bypass the WAF. Finally, we found that with `$()` we can bypass the operator blacklist, but many commands like `echo` or `cat` are blacklisted too.
This is a minor problem, as usually we can bypass it via `c '' a '' t`, and this is a example of that situation.
Knowing this, we could craft a reverse shell to catch it with `penelope` . For this, we need to create it on our attacking host, and download it from the victim via wget.
After setting up our listener with `penelope -p 3110` we will activate it via `$(b''a''s''h /opt/revshell)`.
## 4 - Privilege Escalation
Doing `/find -type f -name "*.txt" 2>/dev/null` we will try to find any .txt file storing credentials or any useful data, and we found the following one:
We can see reading `/etc/passwd` that `vault` is a system user, so we'll try to perform an `hydra` attack on him using that set of passwords:
We found `vault:Yk8$pZ5@cN4!` , so we will access via SSH.
Running the following commands trying to find useful information, we got this files:
As we saw on the SUID listing, we have `/usr/local/bin/vaultctl` with SUID bit activated, and after researching a bit, just by executing it we'll spawn a root shell:
