Nmap shows an open ssh and onscreen port.
With the Onscreenport
A short google search reveals a fitting CVE, https://www.exploit-db.com/exploits/49257. Download the code, register a user, gather the necessary data and run the script to get a shell with the git user.
To get a prettier shell, run
spawn shell python3 -c "import pty;pty.spawn('/bin/bash')" $ export Term=xterm
After a bit of enumeration, the directory /opt/backup with a bunch of interesting files can be found. With the help of
grep -i pass gitlab.rb the files reveal a password.
The password works on the gitlab root account,
root -i wW59U!ZKMbG9+*#h does the trick. But we are still in a docker container and can't access the root directory. Follow the guide and change the
ps aux to whatever command you want to execute. In our case
cat /root/root.txt, the command output can be found in /output.