$ nmap -p- --min-rate 3000 192.168.183.182
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 15:28 +08
Warning: 192.168.183.182 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.183.182
Host is up (0.17s latency).
Not shown: 65519 closed tcp ports (conn-refused)
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
Web Enum -> GraphQL
Port 80 reveals a Gitlab instance:
I tried registering a user, but it wasn't allowed since the Gitlab administrator needed to approve first. I ran a feroxbuster scan to enumerate directories.
$ feroxbuster -u http://192.168.183.182
200 GET 264l 1543w 0c http://192.168.183.182/search
200 GET 353l 2789w 0c http://192.168.183.182/help
301 GET 1l 5w 98c http://192.168.183.182/profile => http://192.168.183.182/-/profile
200 GET 363l 1838w 0c http://192.168.183.182/public
302 GET 1l 5w 105c http://192.168.183.182/snippets => http://192.168.183.182/explore/snippets
302 GET 1l 5w 96c http://192.168.183.182/projects => http://192.168.183.182/explore
401 GET 0l 0w 0c http://192.168.183.182/v2
302 GET 1l 5w 103c http://192.168.183.182/groups => http://192.168.183.182/explore/groups
200 GET 441l 2057w 0c http://192.168.183.182/webmaster
200 GET 441l 2057w 0c http://192.168.183.182/root
200 GET 363l 1838w 0c http://192.168.183.182/explore
There wasn't much from this though. I searched for Gitlab enumeration, hoping to get someone'e cheatsheet on how to enumerate Gitlab instances, but found this instead:
I tried their PoC of accessing Gitlab using /-/graphql-explorer, and it worked:
GraphQL User Enum -> User Login
The CVE above mentions that this allows us to enumerate users using this query:
{users{nodes{id name username}}}
We have 2 new users, coaran and michelle. Then, we can login with michelle:michelle:
Gitlab RCE
Using this user, we can enumerate the version of Gitlab running:
This is vulnerable to the Gitlab Exiftool RCE exploit.
Since this is being run by root, we can create a symlink here that points towards the root user's private SSH key. However, we cannot view the files or write to it as coaron, but it seems the git user can on the Docker container its in.
Afterwards, we just need to wait for a bit before the script executes and makes a new zip file in /opt/backups. Once it does, copy the folder elsewhere and unzip it to reveal the SSH private key of root:
