> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/hard/lfielf.md). # LFIELF ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: port 80 is open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 80 -sS -Pn -sCV` **Result:**

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. With our function `ffuf-dir http://172.17.0.2/FUZZ`, we found:

We browsed all the exposed directories, but the only one relevant now will be index.php. Secret.php has a text talking about "Agent Lin", that could be a valid user for the system. As the machine name is LFIELF, we will fuzz for parameters, trying to find LFI. We found search as a valid parameter, and ended up exposing /etc/passwd.

We could've tried to bruteforce Lin password before, but we didn't know for sure it was a valid user, and it could've been a loss of time. Now, knowing it exists, we will bruteforce the password with hydra: `hydra -l lin -P /path/to/wordlist/rockyou.txt ssh://172.17.0.2` `smbclient //172.17.0.2/macarena -U macarena%donald` will let us download user.txt

## 3 - Exploitation We have full access to the macarena's share, and her password, but we can't use it on SSH. We can create a .ssh folder, and generate a pair of id\_rsa keys, putting our public key inside .ssh/authorized\_keys. That way, we can login into macarena without knowing her password.

Browsing the filesystem we found /home/secret, which contained a file named "hash", containing this: `MMZVM522LBFHUWSXJYYWG3KWO5MVQTT2MQZDS6K2IE6T2===` After passing it to Cyberchef, we found it's a double encrypt, first a Base64 and then a Base32. Decoding it will end up on "supersecurepassword", being the macarena's password.

## 4 - Privilege Escalation Now, we can run sudo -l (we couldn't earlier since it asked for the password), and we found out that macarena can run /usr/bin/file as root. Enumerating the system with: `find / -type f -name "*.txt" 2>/dev/null` we found /opt/password.txt, and opening it with `sudo file -f /opt/password.txt` gave us root password:

## 5 - Summary **Initial Access:**\ FTP anonymous revealed a note → SMB enumeration gave valid creds `macarena:donald`. With write access on the share, we planted an SSH key to access `macarena`. **Exploitation:**\ Found `/home/secret/hash`, decoded it (Base64 → Base32) to `supersecurepassword`, the real password for `macarena`. **Privilege Escalation:**\ With the password, `sudo -l` showed `/usr/bin/file`. Using it, we read `/opt/password.txt` and obtained the root password.