Toolbox

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 5000 10.129.96.171
Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-07 06:28 EDT
Nmap scan report for 10.129.96.171
Host is up (0.0079s latency).
Not shown: 65521 closed tcp ports (conn-refused)
PORT      STATE SERVICE
21/tcp    open  ftp
22/tcp    open  ssh
135/tcp   open  msrpc
139/tcp   open  netbios-ssn
443/tcp   open  https
445/tcp   open  microsoft-ds
5985/tcp  open  wsman
47001/tcp open  winrm
49664/tcp open  unknown
49665/tcp open  unknown
49666/tcp open  unknown
49667/tcp open  unknown
49668/tcp open  unknown
49669/tcp open  unknown

FTP Anonymous Access

We can login to FTP using anonymous, and find an .exe file:

I don't know what this is for, but we'll keep this in mind for now.

MegaLogistics

The HTTPS page shows a freight corporate page:

I took a look at the certificate, and found another subdomain.

Heading to admin.megalogistic.com reveals a login page:

Sending a single ' reveals an SQL error.

So this is vulnerable to SQL Injection, and we can use 'OR 1=1 -- - to bypass the login. On the admin dashboard, we see some stuff regarding credentials:

There wasn't much within the administrator panel for us to use, so let's go back to the SQL Injection and see if we can get a webshell via sqlmap.

This works, and we can get a webshell. The weird part is, this is a Windows machine and I ran id out of instinct. This means that the website and database are probably run within a Docker container. Anyways, we can get a reverse shell via a bash one-liner.

I found the user flag within the /var/lib/postgresql folder:

Privilege Escalation

Docker Escape

Earlier, we found that the administrator needs to send credentials to tony or something. Earlier, we found a docker-toolbox.exe file, and it is probably used to create this Docker.

We can first figure out where other containers are located at via IP Address:

I downloaded the nmap binary onto this machine via curl, and found that SSH was open on 172.17.0.1.

While Googling for docker-toolbox and ssh, I came across this StackOverflow question:

LogoDocker Toolbox SSH LoginStack Overflow

I tried the password and username he specified (which looked default to me) and it worked:

On the docker, we can run sudo su to become root.

SSH Creds

Within /, I found a /c directory:

This is likely the Windows machine file system being mounted, and since we are root, we can go ahead and enumerate it.

Within the .ssh file, we can find an id_rsa private key. Using that, we can ssh in as administrator on the main machine.

PreviousTimelapseNextTopology