> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/medium/dance-samba.md). # Dance-Samba ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: port 21, 22, 139 and 445 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 21,22,139,445 -sS -Pn -sCV` **Result:**

We tried to find exploits or shellcodes using `searchsploit` but there wasn't any. Our next step will be FTP enumeration. We found with our scans that anonymous login is allowed, and accessing it will show just one file, nota.txt:

Knowing we can't do anything else with FTP, we will enumerate SMB now. First, we ran enum4linux, which reported us macarena is a valid user, and macarena is a valid share. Trying to login with: `smbclient //172.17.0.2/macarena -U macarena%donald` will let us download user.txt

## 3 - Exploitation We have full access to the macarena's share, and her password, but we can't use it on SSH. We can create a .ssh folder, and generate a pair of id\_rsa keys, putting our public key inside .ssh/authorized\_keys. That way, we can login into macarena without knowing her password.

Browsing the filesystem we found /home/secret, which contained a file named "hash", containing this: `MMZVM522LBFHUWSXJYYWG3KWO5MVQTT2MQZDS6K2IE6T2===` After passing it to Cyberchef, we found it's a double encrypt, first a Base64 and then a Base32. Decoding it will end up on "supersecurepassword", being the macarena's password.

## 4 - Privilege Escalation Now, we can run sudo -l (we couldn't earlier since it asked for the password), and we found out that macarena can run /usr/bin/file as root. Enumerating the system with: `find / -type f -name "*.txt" 2>/dev/null` we found /opt/password.txt, and opening it with `sudo file -f /opt/password.txt` gave us root password:

## 5 - Summary **Initial Access:**\ FTP anonymous revealed a note → SMB enumeration gave valid creds `macarena:donald`. With write access on the share, we planted an SSH key to access `macarena`. **Exploitation:**\ Found `/home/secret/hash`, decoded it (Base64 → Base32) to `supersecurepassword`, the real password for `macarena`. **Privilege Escalation:**\ With the password, `sudo -l` showed `/usr/bin/file`. Using it, we read `/opt/password.txt` and obtained the root password.