> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/pequenasmentirosas.md).

# PequeñasMentirosas

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

<figure><img src="/files/GIxi3bm5sVQ8PHwWK78r" alt=""><figcaption><p>(PequeñasMentirosas) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
    ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we didn't find anything useful.

Exploring the website, as our last chance, we found just a text:

<figure><img src="/files/dZ0qenex6FkPIqj9MI09" alt=""><figcaption><p>(PequeñasMentirosas) Web Content</p></figcaption></figure>

## 3 - Exploitation

As we don't have another way in, our last chance will be to think `a` is a valid user, and try to bruteforce the password with hydra.

<figure><img src="/files/frLTxUAnJV19hys6utXA" alt=""><figcaption><p>(PequeñasMentirosas) a Credentials</p></figcaption></figure>

## 4 - Privilege Escalation

Running `sudo -l` we can see that `a` doesn't have sudo permissions over any binary. We will run `find / -perm -4000 2>/dev/null` to see if there is any SUID binary, but we can't find anything useful either.

Our next step will be analyzing credentials exposed in .txt across the machine with:

```
find / -type f -name "*.txt" 2>/dev/null
```

<figure><img src="/files/FGEck9ohlKQd4rjk7hfW" alt=""><figcaption><p>(PequeñasMentirosas) Machine FIles</p></figcaption></figure>

Reading /etc/passwd we can see there is another user called spencer, so we will use the hash in `/srv/ftp/hash_spencer.txt` to try to get his password.

Analyzing it with `hashid -m "hash"` will tell us it's MD5, so using:

```
hashcat -m 0 -a 0 'hash' /usr/share/wordlists/rockyou.txt
```

will give us `password1`. We can move horizontally to spencer now.

Running `sudo -l` will show `spencer` has sudo permissions as `root` on `/usr/bin/python3` so using this GTFOBins one-liner will grant us a root shell.

<figure><img src="/files/rEe9BPyASfXgpQUnuFHL" alt=""><figcaption><p>(PequeñasMentirosas) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Exploring the website revealed the hint `a`, used as a username. Hydra brute force succeeded and gave SSH access as `a`.

**Exploitation:**\
No sudo rights or SUID binaries for `a`. Enumeration found `/srv/ftp/hash_spencer.txt`, which contained an MD5 hash. Cracking it revealed `spencer:password1`, allowing horizontal movement.

**Privilege Escalation:**\
User `spencer` had sudo rights on `/usr/bin/python3`. Abusing GTFOBins, we spawned a root shell.