Breakout

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 192.168.183.182
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-12 15:28 +08
Warning: 192.168.183.182 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.183.182
Host is up (0.17s latency).
Not shown: 65519 closed tcp ports (conn-refused)
PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http

Web Enum -> GraphQL

Port 80 reveals a Gitlab instance:

I tried registering a user, but it wasn't allowed since the Gitlab administrator needed to approve first. I ran a feroxbuster scan to enumerate directories.

There wasn't much from this though. I searched for Gitlab enumeration, hoping to get someone'e cheatsheet on how to enumerate Gitlab instances, but found this instead:

LogoCVE-2021-4191: GitLab GraphQL API User Enumeration (FIXED) | Rapid7 BlogRapid7

I tried their PoC of accessing Gitlab using /-/graphql-explorer, and it worked:

GraphQL User Enum -> User Login

The CVE above mentions that this allows us to enumerate users using this query:

We have 2 new users, coaran and michelle. Then, we can login with michelle:michelle:

Gitlab RCE

Using this user, we can enumerate the version of Gitlab running:

This is vulnerable to the Gitlab Exiftool RCE exploit.

LogoGitHub - CsEnox/Gitlab-Exiftool-RCE: RCE Exploit for Gitlab < 13.10.3GitHub

Privilege Escalation

LinPEAS -> SSH Key

I ran linpeas.sh and it found some potential SSH keys.

We can read the file and verify that it is an SSH key:

We know that there are 2 users on the machine, and I tested with both. Using this key, we can ssh in as coaron:

Pspy -> Symlink Exploit

linpeas.sh didn't reveal much, so I ran a pspy64 instead. I found some interesting processes involving zip files:

Since this is being run by root, we can create a symlink here that points towards the root user's private SSH key. However, we cannot view the files or write to it as coaron, but it seems the git user can on the Docker container its in.

We can then create the symlink here:

Afterwards, we just need to wait for a bit before the script executes and makes a new zip file in /opt/backups. Once it does, copy the folder elsewhere and unzip it to reveal the SSH private key of root:

We can then use this key to ssh in as root:

Rooted!

PreviousBratarinaNextBunyIP

Last updated