> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/firsthacking.md).

# FirstHacking

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: port 21 is open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 21 -sS -Pn -sCV`

Result:

<figure><img src="/files/8HeCwJJZigiOGzHU2IV3" alt=""><figcaption><p>(FirstHacking) Targeted Port Scan</p></figcaption></figure>

We will use `searchsploit vsftpd 2.3.4` to see if there exist any exploits for that service version. We found a Backdoor Command Execution exploit, so using `msfconsole` we use it.

## 3 - Exploitation

We setup the exploit using `set RHOSTS 172.17.0.2` and run it, obtaining instantly a root shell.

<figure><img src="/files/YCuw5KAKbWVOqqaBtDHU" alt=""><figcaption><p>(FirstHacking) Root Shell</p></figcaption></figure>

### 4 - Summary

**Initial Access:**\
Nmap enumeration revealed FTP running vsftpd 2.3.4.

**Exploitation:**\
Used the Metasploit module for the vsftpd 2.3.4 backdoor (CVE-2011-2523), which granted immediate RCE.

**Privilege Escalation:**\
Not required – the exploit provided a direct root shell.