Runner
Enumeration
nmap -v -A -p- -Pn runner.htb -oN nmapPort 80
If we try to enumerate directories or files present we get nothing with generic wordlists. Instead, by generating a custom wordlist with cewl from the website pages we get an interesting result:
Now add the new subdomain enumerated in /etc/hosts and continue enumeration...
We also find on the Jetbrains site the CVE listed and from which version onward it was fixed:
Exploitation (foothold)
The exploit simply relies on interacting with some APIs that do not involve authentication in order to create an administrator user even without being authenticated on a TeamCity server. It sends a POST request to the target URL to create an admin user with specified or random credentials.
If we now login using these credentials we obtain a success. In particular, under "Users" section we see there are Matthew and John users:
There also appears to be a Backup section within the administrative console that allows you to download a backup of everything as shown in the figure:
Unzipping the directory and exploring it we will find an id_rsa key file:
If we try to SSH as matthew we obtain an error instead as john is a success and we can get the user flag:
Within the downloaded backup, however, there is also a database_dump folder containing a users file with hashes of TeamCity users:
If we try to crack it using Hashcat:
We will obtain also matthew credentials: matthew <-->piper123
Login as matthew using SSH or su from John console do not work...
Enumeration
Download using curl (wget is not present on the machine) the linpeas from attacking machine and run it:
There is a configuration on the nginx server that exposes another website: portainer-administration.runner.htb
Trying matthew credentials (are the only ones we know!) we can login:
In Portainer, an “environment” represents a managed instance of a container orchestration platform, such as Docker or Kubernetes. An environment can be a single machine with Docker installed, a Kubernetes cluster, a Docker Swarm instance, or a remote Docker instance. There are different types of Environment in Portainer, the one we find configured is a Docker Standalone i.e. a single Docker node.
There are 0 running containers but 2 locally downloaded images are present:
If we try to download another image like node we will obtain an error:
A very quick privilege escalation would have been to create a container in privilege mode. The privileged mode of a Docker container is a mode that grants the container more privileges than the default privileges. When a container is run in privileged mode, it gains access to all the capabilities of the host kernel, which means it can do almost anything the host operating system can do including:
The container can access all devices on the host system, including network devices, storage devices, and other
The container has access to all kernel capabilities, allowing operations that would normally be restricted or prohibited for unprivileged containers
The container can mount filesystems from the host system
The container can upload and download kernel modules
The container can modify various system and network parameters, similar to how a root user would do on the host system.
However, since user matthew is not the administrator of portainer.io it would appear to have been disabled:
However, if we try to create a volume from the Volumes section. There are several options that can be set when creating the volume. One of them is the Bind Mounts type.
you need to specify the type bind:
Now we can finally create the container mapping host file system inside the container file system:
Opening the console we can root the machine 🎉
Last updated