> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/nodeclimb.md).

# NodeClimb

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 21 and 22 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 21,22 -sS -Pn -sCV`

<figure><img src="/files/MsTIuARfvYa3kpWLCIa8" alt=""><figcaption><p>(NodeClimb) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be FTP enumeration. Our report shown that anonymous login is allowed, so we will try to gather as much data as possible.

<figure><img src="/files/M9ZsDRPQXnhUv1MG3MQt" alt=""><figcaption><p>(NodeClimb) SecretitoPicaron.zip</p></figcaption></figure>

## 3 - Exploitation

We got `secretitopicaron.zip`, which is protected by a password, so we will run:

```
zip2john secretitopicaron.zip > hash
john --wordlist=/usr/share/wordlists/rockyou.txt hash
unzip secretitopicaron.zip
password1
```

That will end up on valid credentials for SSH login:

<figure><img src="/files/HBCzqMplZqXP9O0SSIPr" alt=""><figcaption><p>(NodeClimb) Mario Credentials</p></figcaption></figure>

## 4 - Privilege Escalation

After running `sudo -l` we checked `mario` has sudo permissions as root on `/usr/bin/node /home/mario/script.js`, which is empty and writeable by us.

Researching a bit about Node.js, we found the function `exec`, which will run system commands. After writing a malicious `script.js`, we can set SUID on `/bin/bash`, allowing us to spawn a root shell with `/bin/bash -p`

<figure><img src="/files/SDjZaknF8N24nannnMuw" alt=""><figcaption><p>(NodeClimb) Privilege Escalation</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Anonymous FTP access revealed `secretitopicaron.zip`. Cracking it with `zip2john` and John provided SSH credentials for `mario`.

**Exploitation:**\
Logged in via SSH as `mario` using the recovered credentials.

**Privilege Escalation:**\
`mario` had sudo rights on `/usr/bin/node /home/mario/script.js`, which was empty and writable. By injecting a malicious script using `exec` to set SUID on `/bin/bash`, we obtained a root shell.