Ready

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.220 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,5080 10.10.10.220 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

If we take a look at the nginx server on port 5080, we'll see a GitLab server.

Let's create a new user from the Register section.

Once we are logged in, we could see the GitLab version from the Help page.

It is the GitLab 11.4.7 version.

Exploitation

If you do some research on the internet, you'll find that this version of GitLab is vulnerable to a Remote Command Execution exploit. I made my own exploit, which basically exploits a SSRF vulnerability when making a new project by importing a URL. Make sure to change the necessary variables to make the script work.

If we execute the exploit, we'll get a reverse shell as the git user, and we'll be able to grab the user flag.

python exploit.py

Privilege Escalation

First, let's set an interactive TTY shell.

script /dev/null -c /bin/bash

Then I press Ctrl+Z and execute the following command on my local machine:

stty raw -echo; fg

reset

Terminal type? xterm

Next, I export a few variables:

export TERM=xterm

export SHELL=bash

Finally, I run the following command in our local machine:

stty size

And set the proper dimensions in the victim machine:

stty rows 51 columns 236

If we check the IP address, we'll see that we are not in the Ready machine with the IP 10.10.10.220, instead we are probably in a docker container with the IP address 172.19.0.2.

hostname -I

If we enumerate the machine, we'll find the /opt/backups directory with some files.

ls -l /opt/backups

If we check the content of the gitlab.rb file, omitting all the comments, we'll see an SMTP password.

grep -v "^#" /opt/backup/gitlab.rb | xargs

Let's try to become root with that password.

su root

Now we are the root user of the docker container, not the real machine. But, we can't see the root flag yet. If we list the system disk devices, we'll see that the /dev/sda2 filesystem is mounted on /root_pass.

df -h

As we are root, we could try to mount that filesystem in a custom directory.

mkdir /tmp/sda2

mount /dev/sda2 /tmp/sda2/

If now we take a look at the /tmp/sda2 directory, we'll see the filesystem of the Ready machine.

ls -la /tmp/sda2/

If we inspect the root directory, we'll see a id_rsa file under the .ssh directory.

cat /tmp/sda2/root/.ssh/id_rsa

Let's copy it to our local machine, and give it the right permissions.

nano id_rsa

chmod 600 id_rsa

Finally, if we SSH into the victim machine giving the id_rsa file, we'll get a shell as root. Then, all we have to do is reap the harvest and take the root flag.

ssh -i id_rsa root@10.10.10.220

Last updated

Was this helpful?