Registry
Registry is a hard difficulty box that deals with Docker.
Recon
we start off by scanning Forest's IP 10.10.10.159 with nmap
From Our Results we get the following services and ports
From the results we see that ssh http & https are active, but what's interesting here is the ssl-cert: commonName which reveals its docker.registry.htb we can add this to our hosts file
Next let's run nikto and see if we can find anything interesting on both the IP and the docker.registry.htb
our docker.registry.htb nikto scan gives us
interesting it found some credentials under /v2/_catalog
visiting docker.registry.htb/v2/_catalog prompts us for credentials which we have. it then takes us to a page that reveals that is running bolt-cms
The nikto scan on 10.10.10.159 gives us nothing relevant but upon running a dirbuster scan on it we find that it's running bolt-cms
Now that we have confirmed that the target is running docker and we can authenticate into it, we can now go forward and dig into docker registry API https://docs.docker.com/registry/spec/api/
Checking the tag list https://docker.registry.htb/v2/bolt-image/tags/list we find that it has one tag latest navigating to https://docker.registry.htb/v2/bolt-image/manifests/latest gives as a file of all the blobs
Blobs often contain configs on the setup and each blob can be thought of as a git commit
From the API we know that we can download these blobs with the URL https://docker.registry.htb/v2/bolt-image/blobs/sha256:BLOBHASH
From this we can construct a download list
Exploit
and go on to download them, personally i used wget --no-check-certificate --http-user=admin --http-password=admin -i BlobList
Well we got a system dump so to speak within which we find a ssh id_pub for the user bolt and within another blob we find a script to send the ssh password GkOcz221Ftb3ugog
navigating back to the id_rsa we can not ssh into the machine with ssh -i id_rsa bolt@10.10.10.159 once in we can get our first flag!
Post Exploitation
Once in we can use linpeas to find anything interesting and sure enough it finds the following
we can put this hash through john to get
So now we have admin credentials for bolt-cms
After further exploration we find a backup script in /var/www/html/
it seems that whenever this file is triggered it uses sudo to backup the bolt website via restic however we as bolt do not have the privileges to edit or run the above file, so who might? well www-data can since it is the web service that triggers the backup. So how do we get www-data remember the admin credentials from before? we can login and see if there's a path to executing a shell from there. so off we go to http://10.10.10.159/bolt/bolt/ and behold admin credentials
using username:admin password:strawberry gets us access to the cms portal. There seem to be quite a few places we can load a web shell from so let's look around.
Well it seems that xss is a no go, so how else can we get a shell?. There is a dedicated area to uploading files, however php seems to be restricted, this can easily be amended by going to the Main Configuration and searching for accept_file_types once here we can add php as a accepted file type and upload our shell to http://10.10.10.159/bolt/bolt/files/themes/skeleton
I'm personally a fan of WhiteWinterWolf webshell https://github.com/WhiteWinterWolf/wwwolf-php-webshell/blob/master/webshell.php that provides a more stable interface of getting a shell, so let's grab and upload it
Nice, however trying a reverse shell doesn't really work so lets take another approach and set a bind shell with nc.traditional -lp 9999 -e /bin/bash and connect to it.
running sudo -l again gives us
that we can not only execute the backup.php but also execute the restic backup -r rest* we cannot setup a restic server on the target but we can locally
https://github.com/restic/rest-server gives us all the instructions we need to get setup locally. Once we have it installed we can upload restic-server to the target via scp.
Once we've done this we can
once the backup is created we can use
This will decrypt it and give us our flag
Useful Links
Last updated