> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/hedgehog.md). # Hedgehog ## 1 - Reconnaissance We begin with a fast Nmap scan to identify open ports: `nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we run a service/version detection scan, targeting only the open ports we found on the previous scan: `nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV` **Result:**

We tried to find exploits or shellcodes using `searchsploit OpenSSH 9.6p1` and `searchsploit Apache httpd 2.4.58` but there wasn't any. Our next step will be directory enumeration. With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ` we didn't find anything useful, so we will browse the website.

There wasn't anything useful on the source code, and since the machine name is "Hedgehog" and Tails is a character from the game series, we will try to brute-force SSH with Hydra using that username. ## 3 - Exploitation Running: ``` hydra -l tails -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 ``` we found the next credentials: `tails:3117548331`. ## 4 - Privilege Escalation Running `sudo -l` we can see that user `tails` has the next permissions:

Knowing that, we ran `sudo -u sonic sudo -l` and found this:

Finally, we can run `sudo -u sonic sudo su` and we spawn a root shell. ## 5 - Summary **Initial Access:** Obtained valid credentials by discovering an username on the website. The password was cracked using `hydra`. **Execution:** Pivoted to user `sonic` using `sudo` permissions on all commands as `sonic`. **Privilege Escalation:** Elevated privileges to root using `sudo` permissions on all commands as `root`, as it was allowed for the `sonic` user.