> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/vulnvault.md).
# VulnVault
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 22 and 80 are open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`
We tried to find exploits or shellcodes but there wasn't any. Our next step will be directory enumeration. Using our tool **ffuf-dir:**
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we did `ffuf-dir http://172.17.0.2/FUZZ` we found the following routes:
Browsing the website we saw some potential to upload a reverse shell hidden on a txt, but that wasn't a viable path on this machine. Therefore, we started trying with `/index.php`.
## 3 - Exploitation
We decided to try command injection, as it was making a `touch /var/www/html/reportes/ USERINPUT`. After inputting `; cat /etc/passwd` we found this:
As we can see, the only user with a `/home` is `/samara` so we'll try to find relevant data using this.
After checking, `message.txt` and `user.txt` are not useful, but we found a `.ssh` folder.
After copying `id_rsa` we can login as `samara` on the system via private key.
## 4 - Privilege Escalation
We didn't find any sudo rights on any binary nor SUID bit active on useful binaries.
Listing the running processes we find this:
As we can see, `/usr/local/bin/echo.sh` is running as root constantly, and we have write permissions over that file, so changing its content to `chmod +s /bin/bash` will activate SUID bit on bash.
After running `/bin/bash -p` we obtain a root shell: