> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/nodeclimb.md). # NodeClimb Anonymous FTP leak exposed a ZIP with SSH creds, and root was gained via writable Node.js script executed with sudo. ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 21 and 22 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 21,22 -sS -Pn -sCV`

(NodeClimb) Targeted Port Scan

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be FTP enumeration. Our report shown that anonymous login is allowed, so we will try to gather as much data as possible.

(NodeClimb) SecretitoPicaron.zip

## 3 - Exploitation We got `secretitopicaron.zip`, which is protected by a password, so we will run: ``` zip2john secretitopicaron.zip > hash john --wordlist=/usr/share/wordlists/rockyou.txt hash unzip secretitopicaron.zip password1 ``` That will end up on valid credentials for SSH login:

(NodeClimb) Mario Credentials

## 4 - Privilege Escalation After running `sudo -l` we checked `mario` has sudo permissions as root on `/usr/bin/node /home/mario/script.js`, which is empty and writeable by us. Researching a bit about Node.js, we found the function `exec`, which will run system commands. After writing a malicious `script.js`, we can set SUID on `/bin/bash`, allowing us to spawn a root shell with `/bin/bash -p`

(NodeClimb) Privilege Escalation

## 5 - Summary **Initial Access:**\ Anonymous FTP access revealed `secretitopicaron.zip`. Cracking it with `zip2john` and John provided SSH credentials for `mario`. **Exploitation:**\ Logged in via SSH as `mario` using the recovered credentials. **Privilege Escalation:**\ `mario` had sudo rights on `/usr/bin/node /home/mario/script.js`, which was empty and writable. By injecting a malicious script using `exec` to set SUID on `/bin/bash`, we obtained a root shell.