> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/chocolatelovers.md).

# ChocolateLovers

## Maquina

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FMupKJvLtJB1QZMRkdeRs%2Fimage.png?alt=media&amp;token=9ae5d4c6-d0cd-4945-9861-a80d4c2f134f" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sS -sC -sV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 02:42:AC:11:00:02 (Unknown)
```

### Web

Si entramos a la web veremos que es una pagina default de Apache, pero si miramos el codigo veremos que hay un directorio comentado.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FotXFVNrGM9xxMItRDoQD%2Fimage.png?alt=media&amp;token=b9a29eb7-5b7a-4c2f-bc1d-fa87c8824d65" alt=""><figcaption></figcaption></figure>

Si entramos a este directorio veremos esta pagina:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FIKsfDmNP0Eo89HFMvtBQ%2Fimage.png?alt=media&amp;token=ba91b818-ee93-4ce0-9cd8-ee1b2f375f80" alt=""><figcaption></figcaption></figure>

### Gobuster

```bash
sudo gobuster dir -u 172.17.0.2/nibbleblog/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/nibbleblog/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/content              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/content/]
/themes               (Status: 301) [Size: 320] [--> http://172.17.0.2/nibbleblog/themes/]
/admin                (Status: 301) [Size: 319] [--> http://172.17.0.2/nibbleblog/admin/]
/plugins              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/plugins/]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 323] [--> http://172.17.0.2/nibbleblog/languages/]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```

```bash
sudo gobuster dir -u 172.17.0.2/nibbleblog -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/nibbleblog
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              gz,js,rb,jpg,gif,pdf,ini,xml,svg,log,png,py,config,tar,json,backup,php,rar,sql,conf,sh,bash,zip,txt,css,html,ico,jpeg
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/index.php            (Status: 200) [Size: 5015]
/sitemap.php          (Status: 200) [Size: 541]
/content              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/content/]
/themes               (Status: 301) [Size: 320] [--> http://172.17.0.2/nibbleblog/themes/]
/feed.php             (Status: 200) [Size: 1289]
/admin                (Status: 301) [Size: 319] [--> http://172.17.0.2/nibbleblog/admin/]
/admin.php            (Status: 200) [Size: 1401]
/plugins              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/plugins/]
/install.php          (Status: 200) [Size: 78]
/update.php           (Status: 200) [Size: 1792]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 323] [--> http://172.17.0.2/nibbleblog/languages/]
/LICENSE.txt          (Status: 200) [Size: 35148]
/COPYRIGHT.txt        (Status: 200) [Size: 1272]
/.php                 (Status: 403) [Size: 275]
/.html                (Status: 403) [Size: 275]
Progress: 6394970 / 6396269 (99.98%)
===============================================================
Progress: 6396240 / 6396269 (100.00%)Finished
===============================================================
```

## Explotación

### Acceso web

Si revisamos los directorios nos toparemos con un `/admin.php`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FSXp4exjIX40AQTYytL9d%2Fimage.png?alt=media&amp;token=31292f47-59ef-457d-98a1-7560889daecd" alt=""><figcaption></figcaption></figure>

Si usamos las credenciales por defecto `Username=admin` y `Password=admin`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FWPU9ZvgE3VE1Afbyxo5t%2Fimage.png?alt=media&amp;token=1ad7ff8c-5fb2-4663-bce8-7b091a542e11" alt=""><figcaption></figcaption></figure>

Si miramos entre las opciones veremos una que nos permite subir archivos.&#x20;

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F96xLNO2ZdUmP7rvmYCUS%2Fimage.png?alt=media&amp;token=a73f6862-4bcb-422d-a031-56716507c5cd" alt=""><figcaption></figcaption></figure>

Subimos una reverse shell, no aparecerán unos cuantos Warnings, pero si nos dirigimos al directorio donde hemos subido esta shell, hay estará:

{% hint style="info" %}
Hay que buscar bien entre los directorios, esta medio escondido.
{% endhint %}

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FMDqlQCUMn0OeopUGjz0t%2Fimage.png?alt=media&amp;token=d3921f3d-be2a-44a7-8aca-46a12c35047c" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Con esto conseguimos acceso somo el usuario `www-data`:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FhLY79kJQbcK2ZJwXCxCQ%2Fimage.png?alt=media&amp;token=2bd071f0-cdf1-48c0-8647-53036a166d66" alt=""><figcaption></figcaption></figure>

Comprobamos los permisos que tiene este usuario y lo explotamos este binario siguiendo lo que pone en [GTFOBins](https://gtfobins.github.io/).

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FSES13LEwtkqnoifIszWp%2Fimage.png?alt=media&amp;token=acd72cb7-bd9f-40ea-acbc-07ce4f617dc5" alt=""><figcaption></figcaption></figure>

Siendo el usuario `chocolate`, si buscamos entre los directorios daremos con un script que podemos editar.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FYAdOYfouhBZBrbsmoBne%2Fimage.png?alt=media&amp;token=1d786274-7233-447b-8e48-fbe0a12d1b01" alt=""><figcaption></figcaption></figure>

Si editamos este script y ponemos:

```bash
echo '<?php exec(chmod u+s /bin/bash); ?>' > /opt/script.php
```

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FtuRepcRbHQriIj4n9hHp%2Fimage.png?alt=media&amp;token=0bac47df-9cfb-4b6a-96ee-0550f490d6db" alt=""><figcaption></figcaption></figure>

Con esto ya conseguiríamos ser root:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FVZCaDSle0Zn2jzEKPvOh%2Fimage.png?alt=media&amp;token=6debe532-79ff-4697-a33d-6ff7a90323b3" alt=""><figcaption></figcaption></figure>

## Conclusion

Una maquina completa con bastante búsqueda por directorios, uso de credenciales por defecto y escalado de privilegios por binarios y por scripts.