> For the complete documentation index, see [llms.txt](https://hacking-3.gitbook.io/barre/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-3.gitbook.io/barre/write-up/dockerlabs/medio/bashpariencias.md).

# Bashpariencias

## Maquina

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FiOOjJP953nTEuwrayupt%2Fimage.png?alt=media&amp;token=771ca89e-c801-4535-a6f2-96cba53bd45d" alt=""><figcaption></figcaption></figure>

## Reconocimiento

### Nmap

```bash
sudo nmap -p- --open -sSCV --min-rate 5000 -vvv -Pn 172.18.0.2 -oN nmap.txt
```

```
PORT     STATE SERVICE REASON         VERSION
80/tcp   open  http    syn-ack ttl 64 Apache httpd
| http-methods: 
|_  Supported Methods: POST OPTIONS HEAD GET
|_http-server-header: Apache
|_http-title: Leeme
8899/tcp open  ssh     syn-ack ttl 64 OpenSSH 6.6p1 Ubuntu 3ubuntu13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 a3:b0:db:99:e4:c6:a5:b2:5d:2b:36:b6:3e:d0:15:00 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBG8ewQjjOoqPtzvXKk1TWfAl1qcSSWPxiXjhtIBNe4nsj15B8XEd/JeFWaJ95ncwxbja1cdarxlmqSLpLZuST5c=
|   256 8f:26:4e:8c:60:28:5c:14:03:b2:45:22:ae:e1:f9:24 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUJcx6u0eWagjW1BdQxHCwTR1N2CsEUmSLYabG51/J8
MAC Address: 02:42:AC:12:00:02 (Unknown)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Gobuster

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.18.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | tee gobuster.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.18.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/images               (Status: 301) [Size: 233] [--> http://172.18.0.2/images/]
/css                  (Status: 301) [Size: 230] [--> http://172.18.0.2/css/]
/server-status        (Status: 403) [Size: 199]
Progress: 220560 / 220561 (100.00%)
===============================================================
Finished
===============================================================
```

{% code overflow="wrap" %}

```bash
sudo gobuster dir -u 172.18.0.2 -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,html,js,txt,zip,rar,tar,gz,css,xml,json,rb,py,jpg,jpeg,png,gif,svg,ico,pdf,sql,log,ini,conf,config,backup,sh,bash | tee gobusterExt.txt
```

{% endcode %}

```
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.18.0.2
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.6
[+] Extensions:              log,ini,rar,gif,ico,zip,tar,py,jpg,sh,js,xml,sql,jpeg,bash,txt,json,rb,html,gz,conf,css,png,svg,backup,php,pdf,config
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/.html                (Status: 403) [Size: 199]
/index.html           (Status: 200) [Size: 4655]
/images               (Status: 301) [Size: 233] [--> http://172.18.0.2/images/]
/css                  (Status: 301) [Size: 230] [--> http://172.18.0.2/css/]
/form.html            (Status: 200) [Size: 10232]
/app.html             (Status: 200) [Size: 7989]
/shell.php            (Status: 200) [Size: 1558]
/.html                (Status: 403) [Size: 199]
/server-status        (Status: 403) [Size: 199]
Progress: 6395256 / 6396269 (99.98%)
===============================================================
Finished
===============================================================
```

### Web

Una pagina de inicio que contiene un posible usuario de nombre `rosa` y un enlace a la maquina [BuscaLove](/barre/write-up/dockerlabs/facil/buscalove.md).

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FRFD4lwUO87rE6FAF6H37%2Fimage.png?alt=media&amp;token=b1c61108-e123-45be-9eaf-6cfba1f60231" alt=""><figcaption></figcaption></figure>

Si buscamos entre los directorios de esta web veremos que en uno de ellos aparece `rosa` otra vez y si miramos el código veremos `usuario:contraseña` de `rosa`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FNLAQcSkE6Zw7BRKinuzA%2Fimage.png?alt=media&amp;token=c7a8221e-fb93-4b0d-bb1f-053eb5859a45" alt=""><figcaption></figcaption></figure>

## Acceso

Por lo que ahora podemos entrar por ssh

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FUwQNVYmZYipacIKwRoyQ%2Fimage.png?alt=media&amp;token=a22814dd-2e7d-4da6-be9f-aa4119aa8e94" alt=""><figcaption></figcaption></figure>

## Escalado de privilegios

Miramos los permisos de rosa

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FW8mqjk2fgmPgrve0C8Q8%2Fimage.png?alt=media&amp;token=7acd6d4d-e614-4d30-8fc3-4530581d64d5" alt=""><figcaption><p><em>Nada que destacar en cuanto a permisos</em></p></figcaption></figure>

Miramos un poco por los directorios

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FhtdSkiJybECuJ5hGM89f%2Fimage.png?alt=media&amp;token=e05c0d13-f8b7-4002-87a2-b71b545448f5" alt=""><figcaption></figcaption></figure>

{% hint style="warning" %}
Archivo megasecret.txt, pero no tenemos permiso para verlo
{% endhint %}

{% hint style="info" %}
Usuarios Carlos y Juan
{% endhint %}

En el directorio - de rosa hay 2 archivos, backup\_rosa.zip e irresponsable.txt

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FTnocjgwQDS7oHFpgujCv%2Fimage.png?alt=media&amp;token=539c8672-345c-4ab1-8c50-877c282e5066" alt=""><figcaption></figcaption></figure>

Si intentamos sacar el contenido del zip nos pide una contraseña que no sabemos

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FNWpcj0B3y921fiptP64X%2Fimage.png?alt=media&amp;token=43d04098-4239-4a21-b832-c148b4554055" alt=""><figcaption></figcaption></figure>

Por lo que nos sacamos el zip a nuestro equipo para crakearlo

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F74GZdl9THfTMQI5Zjx5X%2Fimage.png?alt=media&amp;token=76b5c274-536d-4f09-9694-53f80bcffbb8" alt=""><figcaption></figcaption></figure>

Procedemos al crakeo con [John The Ripper](/barre/apuntes/red-team/tools/john-the-reaper.md)

> Si no sabes como se crakea un zip podéis ver este video de 3 minutos [xerosec](https://www.youtube.com/watch?v=jrOA7p42dPc) o seguir leyendo esto.

1º Usamos `zip2john` para sara los hashes del `.zip` y los extraemos a una archivo de nombre `zip.hash` en este caso.

```bash
zip2john backup_rosa.zip > zip.hash
```

{% code title="zip.hash" overflow="wrap" %}

```
backup_rosa.zip/password.txt:$pkzip$1*2*2*0*19*d*6a3d5968*0*46*0*19*1b29*7100e91e2fa1c71610c9e952d0895dbc2448afa8aa50f4e4e3*$/pkzip$:password.txt:backup_rosa.zip::backup_rosa.zip
```

{% endcode %}

2º Usamos `John` indicándole el diccionario con `-w=` en este caso yo uso `rockyou`, y a continuación poneis el archivo generado anteriormente con `zip2john`

```bash
john -w=/usr/share/wordlists/rockyou.txt zip.hash
```

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2Fy5I9NMk7fg3xTw2iBd01%2Fimage.png?alt=media&amp;token=dc87df36-da97-43a7-aa1f-2a15e4bd306c" alt=""><figcaption></figcaption></figure>

Ahora usamos esta contraseña para abrir el zip y así sacar la contraseña de Juan

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FAWHb5VrDglh7TppcWFaW%2Fimage.png?alt=media&amp;token=89445b96-709f-48f1-8420-6b6df3ebb7a0" alt=""><figcaption></figcaption></figure>

Nos cambiamos de usuario a juan

### Juan

Miramos sus permisos

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FJjnGat4J7ay77x2CuNrn%2Fimage.png?alt=media&amp;token=c9719e13-063b-4a47-9ce3-cb3ff04b9489" alt=""><figcaption></figcaption></figure>

Podemos combinar estos 2 permisos para ver que tiene el usuario carlos

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2F1oaUbt1FIw1fw87p9vGI%2Fimage.png?alt=media&amp;token=6a5848f5-1427-48c9-8dbc-33dae5c28919" alt=""><figcaption></figcaption></figure>

Sacamos su contraseña :tada: ahora nos cambiamos de usuario a carlos

### Carlos

Miramos sus permisos

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FOTVey7v7AK77uIZWdEgG%2Fimage.png?alt=media&amp;token=bbbbb076-405e-4d9d-aa35-afc26dea68e9" alt=""><figcaption></figcaption></figure>

Este comando nos permite agregar una línea a un archivo, se me ocurre agregar un usuario a `/etc/passwd`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FBiGFNkXqFhfXa1vwxjrp%2Fimage.png?alt=media&amp;token=7a13a90e-07f9-4a96-9bd0-0b301cafd486" alt=""><figcaption></figcaption></figure>

Cambiándonos a este usuario que acabamos de crear ya seremos `root`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FlHilzBg4cXG7lNaTBGkZ%2Fimage.png?alt=media&amp;token=17cba78d-ea94-44f0-89f2-3a2b10acd745" alt=""><figcaption></figcaption></figure>

## Bonus

Descubramos que contiene el archivo `megasecret.txt`

<figure><img src="https://2700507804-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FXLTbJaeg92PRVBDD3bHb%2Fuploads%2FtV31XhLUBCKv8fvDzEEm%2Fimage.png?alt=media&amp;token=72a2572c-e496-49df-b199-4c6dcb72ebf3" alt=""><figcaption></figcaption></figure>

## Conclusión&#x20;

Maquina muy entretenida, no es muy complicada pero es bastante completa, destacando en su escalado de privilegios.