MonitorsTwo

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 10.129.78.86
Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-29 23:41 EDT
Nmap scan report for 10.129.78.86
Host is up (0.16s latency).
Not shown: 65532 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http

Another web-based exploit.

Cacti

When we check the web port, we see that it is running Cacti.

The version run is actually vulnerable to one unauthenticated RCE exploit, and there are tons of PoCs online to use.

LogoGitHub - ariyaadinatha/cacti-cve-2022-46169-exploit: This is poc of CVE-2022-46169 authentication bypass and remote code executionGitHub

This has to do with the polling of Cacti, and we just need to modify the exploit to point to our own IP address to get a shell.

Privilege Escalation

We got a shell on the docker, so the next step is to escape it.

MySQL Passwords

Within the / directory, we can find a bash script:

Here's the content of it:

So we have a database password and we can enumerate the database. This docker doesn't have python, so we cannot spawn a shell via pty. Instead, we have to use the -e flag to enumerate the database since we don't have a proper shell.

We can extract the hashed password for the users within the database:

I ran john on the hashes, and managed to crack one of them to get funkymonkey.

With this and a username, we can ssh into the machine as marcus. Then, grab the user flag.

CVE-2021-41091 -> Root Shell

Within the /var/mail folder, there's some mail for marcus:

The first 2 vulnerabilities are not relevant, but the last one was rather interesting.

LogoNVD - CVE-2021-41091nvd.nist.gov

In short, it appears that when dockers are created, some of the SUID binaries are carried over. In that case, we can enumerate the SUID binaries on the machine and find these using LinPEAS:

capsh has the SUID binary set, which is not the norm. Based on GTFOBins, we can run this command to spawn a root shell:

Great! Now we are root on the docker. Now, we can find the mounted point of this docker from the main machine, and we can create a bash SUID binary to get a shell.

First we need to find the mount point using df:

At/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged would bring us to the file system of the docker container. Then, using our root shell on docker, we can just use chmod u+s /bin/bash to spawn a SUID binary for the main machine to use.

This works because of the CVE allowing for us to create SUID binaries across machines.

We can see the SUID bash binary here:

We can get a root shell easily:

Rooted!

PreviousMailroomNextOnlyForYou

Last updated