Nmap shows an open ssh and onscreen port.
With the Onscreenport
A short google search reveals a fitting CVE, https://www.exploit-db.com/exploits/49257. Download the code, register a user, gather the necessary data and run the script to get a shell with the git user.
To get a prettier shell, run
spawn shell python3 -c "import pty;pty.spawn('/bin/bash')" $ export Term=xterm
After a bit of enumeration, the directory /opt/backup with a bunch of interesting files can be found. With the help of grep -i pass gitlab.rb
the files reveal a password.
The password works on the gitlab root account, root -i wW59U!ZKMbG9+*#h
does the trick. But we are still in a docker container and can't access the root directory. Follow the guide and change the ps aux
to whatever command you want to execute. In our case cat /root/root.txt
, the command output can be found in /output.