> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/vacaciones.md). # Vacaciones Fast port scanning, service enumeration, SSH brute-forcing, and privilege escalation via sudo on /usr/bin/ruby. ## 1 - Reconnaissance We begin with a fast **Nmap** scan to identify open ports: ``` nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5 ``` **Result: ports 22 and 80 are open** ## 2 - Enumeration Now we will run a service/version detection scan, targeting only the open ports we found on the previous scan: ``` nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV ``` **Result:**

(Vacaciones) Targeted Port Scan

After enumerating directories with: ```bash ffuf -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt:FUZZ -u http://172.17.0.2/FUZZ -e .html,.php ``` we found: **/index.htm**l -> Accessing this will show an Apache2 Debian Default Page. **/javascript** -> Accessing this will show a 403 Forbidden. Knowing this, we will enumerate directories under **/javascript**. We found **/jquery** so we will keep doing the same until we find a route. After running it again, we found this is a rabbit-hole, so we will inspect the source code of the website. We found an interesting comment where we can find two potential **SSH** usernames:

(Vacaciones) Source Code Finding

## 3 - Exploitation We will run **hydra** on the usernames we found. Making a users.txt with both names and running: ```bash hydra -L users.txt -P /usr/share/wordlists/rockyou.txt ssh://172.17.0.2 ``` we found:

(Vacaciones) SSH Credentials

On the comment they mentioned an email, so we browse to **/var/mail** and find **correo.txt** containing credentials for the user **juan**:

(Vacaciones) Plain-text Credentials on an email

We can't find any interesting file or clue we could follow, so running `sudo -l` we found user **juan** can run `/usr/bin/ruby` as sudo. ## 4 - Privilege Escalation We saw the `sudo` perms on `/usr/bin/ruby` for user **juan**, so browsing GTFOBins we found an exploit to escalate privileges to **root**; ```bash sudo ruby -e 'exec "/bin/sh"' ``` As we can see, this spawns a **root** shell:

(Vacaciones) Root Shell

## 5 - Summary **Initial Access:**\ SSH credential brute-forcing with enumerated usernames. **Exploitation:**\ Reconnaissance via user files and mail to extract credentials. **Privilege Escalation:**\ Root shell obtained by abusing sudo permissions on `/usr/bin/ruby`.