> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/library.md).

# Library

## Maquina

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FiQcPAiNyiOMykHQvpeE4%2Fimage.png?alt=media&amp;token=0a2d2c0c-a83c-44cb-a220-7072ba2ad9b1" alt=""><figcaption></figcaption></figure>

## Escaneo

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -n -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 f9:f6:fc:f7:f8:4d:d4:74:51:4c:88:23:54:a0:b3:af (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOE+AMUTmmJFie8NgXoV0LWMWmHQU2yXAMVJnPC/JPzRYOstWvVS+YjLNy2mNK2aKFi/ubqYfwGq5IkKZgXTUEA=
|   256 fd:5b:01:b6:d2:18:ae:a3:6f:26:b2:3c:00:e5:12:c1 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKaYjuffpq2p5LshURmRdGCPjM1gO/+OI5UZ4l37IkRF
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.58 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET POST OPTIONS HEAD
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/javascript           (Status: 301) [Size: 313] [--> http://172.17.0.2/javascript/]
/server-status        (Status: 403) [Size: 275]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              tar,backup,gz,xml,py,ico,sql,ini,gif,php,js,txt,css,json,jpg,html,bash,jpeg,png,svg,config,rar,rb,pdf,conf,log,zip,sh
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/index.html           (Status: 200) [Size: 10671]
/index.php            (Status: 200) [Size: 26]
/javascript           (Status: 301) [Size: 313] [--> http://172.17.0.2/javascript/]
/.html                (Status: 403) [Size: 275]
/server-status        (Status: 403) [Size: 275]
Progress: 6396240 / 6396269 (100.00%)
===============================================================
Finished
===============================================================
```

### Web

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FBm1u0eC8d35QEgsCKRMW%2Fimage.png?alt=media&amp;token=03973dea-2533-42e3-bd5b-9b46b6fd1fd4" alt=""><figcaption></figcaption></figure>

## Explotación

Lo único que encontramos es una posible contraseña, por lo que probamos a hacer un ataque de fuerza bruta con [hydra](/barre/apuntes/red-team/tools/hydra.md).

```bash
hydra -L /usr/share/wordlists/rockyou.txt -p JIFGHDS87GYDFIGD 172.17.0.2 ssh -t 50
```

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FARpBXldM7i5EEXRfyfq9%2Fimage.png?alt=media&amp;token=63b8c24f-a271-440c-9f47-2b789feb4739" alt=""><figcaption></figcaption></figure>

Ahora podemos entrar por ssh con este usuario y esta contraseña.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FtzZizQQ72vRe6QwUMRSR%2Fimage.png?alt=media&amp;token=0d7aee4e-dda6-4f34-9e14-c8298f8c4799" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de este usuario, vemos que podemos ejecutar un script de python.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FQy4Dd51n9ZAjdt8wKGDH%2Fimage.png?alt=media&amp;token=67b1de42-6532-4b32-af71-4589701e9358" alt=""><figcaption></figcaption></figure>

Podemos editar este script para ser root, para editar el archivo tenemos que dar permisos de escritura, podemos porque somos propietarios de este archivo.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FpGoDVEq0iSEqvSwB4y21%2Fimage.png?alt=media&amp;token=c76b39d1-830d-4249-b288-b93133060749" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FJqdXi7vt0WAU1VqtUROx%2Fimage.png?alt=media&amp;token=8335d887-9243-498d-9a3b-e9a9a1e167a0" alt=""><figcaption></figcaption></figure>

Si ejecutamos este script ya seremos root.

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FK6zIxXOULBOWA0g0GIYo%2Fimage.png?alt=media&amp;token=a8d85988-f78a-43c8-a419-03a0c2fafd68" alt=""><figcaption></figcaption></figure>

## Conclusión

Es una maquina corta y de poca complicación, recomendada para practicar cosas basicas.