> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/move.md).
# Move
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 21, 22, 80 and 3000 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 21,22,80,3000 -sS -Pn -sCV`
Using our tool **ffuf-dir:**
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we did `ffuf-dir http://172.17.0.2/FUZZ` we found the following routes:
Browsing `/index.html` gets us on a default Apache2 page, but `/maintenance.html` reveals relevant information:
We found an exploit via `searchsploit` on Grafana, allowing Directory Traversal and Arbitrary File Read. We will try to use it to read the file we found on `/maintenance.html`.
## 3 - Exploitation
We will perform an `hydra` attack using a username wordlist and the password we found previously:
We got `freddy:t9sH76gpQ82UFeZ3GXZS` credentials, so we will access via SSH.
## 4 - Privilege Escalation
After running `sudo -l` we found that user `freddy` has sudo permissions as root on `/usr/bin/python3 /opt/maintenance.py`.
By changing the content on `/opt/maintenance.py` to an exploit found in GTFOBins, we obtain a root shell.
## 5 - Summary