> For the complete documentation index, see [llms.txt](https://oliver-3.gitbook.io/redteam-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://oliver-3.gitbook.io/redteam-notes/dockerlabs/los-40-ladrones.md).

# Los 40 ladrones

Herramientas y recursos:  nmap feroxbuster hydra

sudo nmap -p- --open -sS -sC -sV --min-rate=5000 -vvv -n -Pn 172.17.0.2

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FJZQDqBcugnplqPZUSmnt%2Fimage.png?alt=media&#x26;token=7baf6115-9cda-4551-b89d-7316f9f329b0" alt=""><figcaption></figcaption></figure>

Procedo a revisar la web, y luego a realizar un fuzzing en busca de directorios

feroxbuster -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -t 400 -u <http://172.17.0.2Comment>

No enccontre ningún directorio, asique probe buscando ficheros.

feroxbuster -w /usr/share/wordlists/SecLists/Discovery/Web-Content/directory-list-lowercase-2.3-big.txt -t 400 -x php,txt,jpg -u <http://172.17.0.2>

Logrando detectar: /qdefense.txt

172.17.0.2/qdefense.txt&#x20;

Lo que se ve, es un posible usuario y lo que podrían ser puertos a escanear

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FaXLeZqOKrrmm2DtJhJXo%2Fimage.png?alt=media&#x26;token=0181b7aa-4208-4ce1-8d83-6a10c62a78cd" alt=""><figcaption></figcaption></figure>

\
Con un nuevo escaneo realizado con nmap, ahora el puerto 22 figura abierto.

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FlBUpbVG5XBGfwl6WMIG4%2Fimage.png?alt=media&#x26;token=c134b4f3-474b-46a1-9cbe-7206c9492ac6" alt=""><figcaption></figcaption></figure>

Recordando el posible usuario "toctoc" encontrado en el fichero /qdefense.txt lanzo un ataque de fuerza bruta con hydra

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2F9f7hwCODrwAWEhtN2SrT%2Fimage.png?alt=media&#x26;token=461a52ab-0a2d-46d1-b98a-ba83a93cf966" alt=""><figcaption></figcaption></figure>

Logro conseguir acesso via ssh con las siguientes credenciales&#x20;

Usuario: toctoc Password: kittycat

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FMEaNhJQvajkGov6n2RGW%2Fimage.png?alt=media&#x26;token=f4f510bc-e64d-471f-897c-ccf48443a410" alt=""><figcaption></figcaption></figure>

***

Tratamiento de TTY&#x20;

Una vez logueado con el usuario toctoc, antes de buscar como escalar privilegios, realizo un tratamiento de TTY para conseguir una shell más estable

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2Fi0jqeHx1GxLBnNt57BrP%2Fimage.png?alt=media&#x26;token=a48e196b-7dae-4e18-8ec2-3dbcf1bca043" alt=""><figcaption></figcaption></figure>

Ejecuto "reset xterm" para resetear la terminal y por ultimo exporto las siguientes dos \*variables de entorno\*

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FURJGFVER7zYupxIVcuVE%2Fimage.png?alt=media&#x26;token=1c33a28e-0285-4e3d-90db-c1c3da33df92" alt=""><figcaption></figcaption></figure>

Una vez realizado el tratamiento de la TTY con una shell más estable:

Escalazion de privilegios

Comenzando por ejecutar el comando **sudo -l** para listar los privilegios de sudo del usuario actual.&#x20;

Este comando es útil para verificar si el usuario puede ejecutar algún comando como root sin serlo

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2F99QH4llc5CfB5cmHzcOf%2Fimage.png?alt=media&#x26;token=f196b6b5-5a4c-45f7-9219-6e0c2feaee3b" alt=""><figcaption></figcaption></figure>

Como resultado figura el directorio /opt/bash el cual ejecutare para obtener permisos root

<figure><img src="https://files.gitbook.com/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFLJd1oOCK7xiQmOAEfVk%2Fuploads%2FDQHASf8sVAk7l2pmViqj%2Fimage.png?alt=media&#x26;token=09b01699-1123-4b13-b3cb-c1d3df984ea5" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://oliver-3.gitbook.io/redteam-notes/dockerlabs/los-40-ladrones.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.