📦 HTB - Ready

Cool box, maybe too easy for a medium? Got reverse shell in minutes, but stuck for root’s password for hours 😅
TL;DR
Gitlab RCE, get reverse shell. Privesc with cleartext root password, escape Docker to own the box.
Footholds
nmap
|
|
We get an NGINX service running on port 5080
, and we know there is a GitLab on it. Let’s check it out!
Entrypoint
First thing I did was creating an account to see what’s up with this GitLab. Unfortunately, there is no open projects we can mess with:
A common reflex here is to check the version of the service, let’s go to /help
:
This seems very interesting for us! What do we have for this version?
Well, we can see there are a lot of exploits in the wild. Let’s use the first we find: https://github.com/dotPY-hax/gitlab_RCE
|
|
We follow the instructions, and create a listener with netcat:
|
|
And we got a reverse shell!
User
Very simple user here:
|
|
Upgrade shell
We want a good shell here:
|
|
We want to get root now.
Root
The classical privesc enumerators, like linenum
, linpeas
or lse
are telling us we are in a Docker container. We will firstly try to get root in the container in order to escape from it later.
Get root in container
Running the enumeration scripts, we get some passwords on the system:
Of course, there is no way a GitLab SMTP password could be root’s as well, right?
Escape the container
Now that we are root in the container, it is pretty easy to escape:
|
|
Reference: https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout#i-own-root