Sirol

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 4000 192.168.219.54
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-05 11:18 +08
Nmap scan report for 192.168.219.54
Host is up (0.17s latency).
Not shown: 65529 filtered tcp ports (no-response)
PORT      STATE  SERVICE
22/tcp    open   ssh
53/tcp    closed domain
80/tcp    open   http
3306/tcp  open   mysql
5601/tcp  open   esmagent
24007/tcp open   unknown

Kibana RCE

Port 5601 had a Kibana instance running:

Using the Dev Tools Console, we can check the version that is running:

This version is vulnerable to an RCE exploit:

LogoGitHub - Cr4ckC4t/cve-2019-7609: Kibana <6.6.0 RCE written in python3GitHub

Using the above PoC, we can get a shell on the Docker Container:

Privilege Escalation

Mount -> Docker Escape

We can use fdisk to check the drives that are available:

/dev/sda1 was likely to be the host machine, and we can try to use mount on it:

The above commands would give us root access over the host machine's file system:

Using this, we can echo our own SSH public key into the authorized_keys folder for the root user, and then just ssh in:

Rooted!

PreviousRoquefortNextShiftdel

Last updated