> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/vacaciones.md).
# Vacaciones
## 1 - Reconnaissance
We begin with a fast **Nmap** scan to identify open ports:
```
nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5
```
**Result: ports 22 and 80 are open**
## 2 - Enumeration
Now we will run a service/version detection scan, targeting only the open ports we found on the previous scan:
```
nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV
```
**Result:**
(Vacaciones) Targeted Port Scan
After enumerating directories with:
```bash
ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u http://172.17.0.2/FUZZ -e .html,.php
```
we found:
**/index.htm**l -> Accessing this will show an Apache2 Debian Default Page.
**/javascript** -> Accessing this will show a 403 Forbidden.
Knowing this, we will enumerate directories under **/javascript**. We found **/jquery** so we will keep doing the same until we find a route. After running it again, we found this is a rabbit-hole, so we will inspect the source code of the website.
We found an interesting comment where we can find two potential **SSH** usernames:
(Vacaciones) Source Code Finding
## 3 - Exploitation
We will run **hydra** on the usernames we found. Making a users.txt with both names and running:
```bash
hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2
```
we found:
(Vacaciones) SSH Credentials
On the comment they mentioned an email, so we browse to **/var/mail** and find **correo.txt** containing credentials for the user **juan**:
(Vacaciones) Plain-text Credentials on an email
We can't find any interesting file or clue we could follow, so running `sudo -l` we found user **juan** can run `/usr/bin/ruby` as sudo.
## 4 - Privilege Escalation
We saw the `sudo` perms on `/usr/bin/ruby` for user **juan**, so browsing GTFOBins we found an exploit to escalate privileges to **root**;
```bash
sudo ruby -e 'exec "/bin/sh"'
```
As we can see, this spawns a **root** shell:
(Vacaciones) Root Shell
## 5 - Summary
**Initial Access:**\
SSH credential brute-forcing with enumerated usernames.
**Exploitation:**\
Reconnaissance via user files and mail to extract credentials.
**Privilege Escalation:**\
Root shell obtained by abusing sudo permissions on `/usr/bin/ruby`.