> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/paradise.md).
# Paradise
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 22, 80, 139 and 445 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 22,80,139,445 -sS -Pn -sCV`
Using `enum4linux` we found 2 system users, `andy` and `lucas`:
We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:
```
ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt }
```
we ran `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:
Browsing the website we found this Base64 string containing `estoesunsecreto`:
After browsing `172.17.0.2/estoesunsecreto` we found the following message:
## 3 - Exploitation
Knowing that information, we decided to perform an `hydra` attack on `lucas` account, using `rockyou.txt` as wordlist, finding `lucas:chocolate`.
Pasted image 20260411124031.png
## 4 - Privilege Escalation
After logging in through SSH as `lucas` we ran `sudo -l`, finding this users has sudo permissions as `andy` on `/bin/sed`. Looking on GTFOBins we find the following exploit, obtaining us an `andy` shell:
```
sed -n '1e exec /bin/sh 1>&0' /etc/hosts
```
We ran `find / -perm -4000 2>/dev/null` and found the following:
That `backup.sh` is interesting for us, since it's checking if there is a file on `/tmp/cron-vuln.sh` and then executes it.
Sadly, after researching and trying many ways to get `cron-vuln.sh` hijacked we discover it's a rabbithole. After running `/usr/local/bin/privileged_exec` we instantly get a `root` shell: