> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/try-harder/linux/peppo.md).

# Peppo

Writeup for Peppo from offsec Proving Grounds

## Information Gathering

`sudo ./nmapAutomator.sh 192.168.137.60 all`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FRnnZh4Q59XWOeZESVsy1%2Fimage.png?alt=media\&token=6eb48afe-81b2-4392-a874-7b6171397d15)

### Service Enumeration

### HTTP (Port 8080)

Seems like Redmine is running on port 8080, we try the default credentials `admin:admin` and we are authenticated.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FrhMax01ncnWv7L377Wu2%2Fimage.png?alt=media\&token=78dec100-308a-4257-804f-ba6d129e9091)

Under `/admin/info`, we can see the version this Redmine is running, however, it doesn't seem to be a version with any exploits.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FgDMN3jJq11tp5Mw6Kd02%2Fimage.png?alt=media\&token=c3fa7f0e-2353-4da6-a326-992d34ad7b34)

### HTTP (Port 10000)

Nothing much on here. Looks like another dead end. 

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FJl7e20qIMyO6YjCTX4mE%2Fimage.png?alt=media\&token=29414081-c50e-4153-a576-0319383dfd72)

### Postgresql (Port 5432)

We can try default credentials `postgres:postgres` and we are easily authenticated.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FEqEnfZwYZ2vwSCqItSrH%2Fimage.png?alt=media\&token=4f897a02-4a42-4486-afd0-371b2824bbce)

We are able to get RCE, however, further enumeration shows that this is likely a rabbit hole as I spent hours on here not being able to find any means to privilege escalate. :/ 

### Ident (Port 113)

{% embed url="<https://book.hacktricks.xyz/pentesting/113-pentesting-ident#ident-user-enum>" %}

We enumerate the users on every port. We notice that there is a user Eleanor.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FI3pIKOWbFggPCHfp9T58%2Fimage.png?alt=media\&token=6d3410bc-6518-459c-92ea-3df888747de7)

### SSH (Port 22)

We try to ssh into Eleanor using `eleanor:eleanor` and we are able to get a shell.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FlA0YCh1XFePEBk7GsBJy%2Fimage.png?alt=media\&token=bbd77089-c9ca-4141-9cf6-205d39fea5dc)

## Exploit

From the image above, it seems like we are in a `rbash` - restricted bash, which limits us in terms of the commands we can use.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FGvp8fWsXP1Z1clJdURCu%2Fimage.png?alt=media\&token=cdaa565f-4fb4-4093-a65a-e59ddc77b560)

Searching online for `rbash` escapes, I came across this site:&#x20;

{% embed url="<https://www.hacknos.com/rbash-escape-rbash-restricted-shell-escape>" %}

There is a method that allows us to escape using `ed`.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F2ZXPS6QkW8UgYnAiHvRI%2Fimage.png?alt=media\&token=3dace3a0-618c-4bc2-846c-05b6286adff1)

## Privesc

We notice from our earlier id command that we are part of the docker group. From gtfobins, there is a way to privesc using docker.

{% embed url="<https://gtfobins.github.io/gtfobins/docker#shell>" %}

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FvutUbFFtJAu148MQqGlM%2Fimage.png?alt=media\&token=4c88dca7-9dd0-47ca-807b-c4f6373e9520)

And we got root!