> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/borazuwarahctf.md).
# BorazuwarahCTF
## 1 - Reconnaissance
We begin with a fast Nmap scan to identify open ports:
`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`
**Result: port 22 is open**
## 2 - Enumeration
Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:
`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`
**Result:**
(BorazuwarahCTF) Targeted Port Scan
After running `searchsploit OpenSSH 7.7` and `searchsploit OpenSSH 9.2p1` we didn't find anything useful, and we proceed to explore the website.
We see an image, and we suspect it might be stego-related, so we download it and run `strings imagen.jpeg`. We found this:
(BorazuwarahCTF) Credentials
Now that we have a valid username, we will apply an Hydra attack to bruteforce the SSH service:
```
hydra -u borazuwarah -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```
We found the password `123456`
## 3 - Exploitation
As we have valid credentials for `borazuwarah`, all we need to do is:
```
sshpass -p 123456 ssh borazuwarah@172.17.0.2
```
After that, we logged in as borazuwarah and have control of the machine.
## 4 - Privilege Escalation
Now that we have SSH connection, we run `sudo -l` and see that we have permissions to run `sudo` without password on `/bin/bash`, so we run `sudo /bin/bash` and we spawn a `root` shell.
## 5 - Summary
**Initial Access** Obtained valid credentials by applying an Hydra attack to SSH service.
**Privilege Escalation** Escalated privileges using `sudo` without needing a password on `/bin/bash`.
**Knowledges Applied** Nmap enumeration, Steganography, Hydra,