# Leakage ## nmap ``` mdkir nmap sudo rustscan -a 172.31.1.6 --ulimit 5000 -- -T4 -A -oA nmap/all-ports-service-scan ``` A web server on port 80 is open

Upon checking, looks like it has GitLab installed

## Web enumeration First, create a GitLab account, and log in. Once logged in, check the projects section. You will notice there's a public repository of Jonathan.

The CMS repository sounds interesting, let's take a look and check the commit logs.

Click at the third commit, you will see credentials that have been removed.

Take note the `SQL_LOGIN` and `SQL_PWD` of user `jonathan` then use this credential to log in on GitLab. ![](https://3211174753-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MhuCb52HTt9nZusE7xn%2F-MjLFE8kI5GosblizckN%2F-MjLHc0KQlpBxiNBByDi%2Fimage.png?alt=media\&token=2e50d58c-47de-4138-a8f4-0838e5028abe) Upon logging in, there's an interesting repository called `security`.

Right out of the bat, you will see the shiny gold called `id_rsa`. Let's copy it to our local machine.

## Exploitation Looks like the private SSH key has a password.

Let's perform a dictionary attack using `john` ``` ssh2john jonathan_id_rsa > jonathan_id_rsa.ssh2john john jonathan_id_rsa.ssh2john -w=/opt/wordlist/rockyou.txt ``` After a few seconds, we got the password. Sweet :D

Now we can log in using the private SSH key, the password, and the username we have found.

## Post Exploitation First, let's transfer `linpeas.sh` from our machine to the target machine

You can find the machine IP address by executing the following.

Then transfer the script using `wget`

And run `linpeas.sh`

After quite some time, looks like the SUID of `/bin/nano` is set. We can use this to gain root by writing a new user on /etc/passwd.

First, execute `nano /etc/passwd` to get to editing mode. And at the very bottom, paste the following and hit save. ``` root2:WVLY0mgH0RtUI:0:0:root:/root:/bin/bash ``` Now we can log in, as root with password `mrcake` ``` jonathan@leakage:~$ su root2 Password: mrcake root@leakage:/home/jonathan# ``` Thanks, and enjoy!