Post cover image
Advent of Cyber 4 (2022). To check out the room, click here.

December 14, 2022

Advent of Cyber 2022 : [Day 9 Walkthrough]

[Day 9] Pivoting Dock the halls

By Muhammad Abdullah Niazi

3 min read

Learning Objectives

  • Using Metasploit modules and Meterpreter to compromise systems
  • Network Pivoting
  • Post exploitation

What is Docker?

Docker is a way to package applications and the associated dependencies into a single unit called an image. This image can then be shared and run as a container, either locally as a developer or remotely on a production server. A common way to tell if a compromised application is running in a Docker container is to verify the existence of a /.dockerenv file at the filesystem's root directory.

What is Metasploit?

Metasploit is a powerful penetration testing tool for gaining initial access to systems, performing post-exploitation, and pivoting to other applications and systems. Metasploit is free, open-source software owned by the US-based cybersecurity firm Rapid7.

What is a Metasploit session?

After successfully exploiting a remote target with a Metasploit module, a session is often opened by default. These sessions are often Command Shells or Meterpreter sessions, which allow for executing commands against the target. It's also possible to open up other session types in Metasploit, such as SSH or WinRM — which do not require payloads.

What is Meterpreter?

Meterpreter is an advanced payload that provides interactive access to a compromised system. Meterpreter supports running commands on a remote target, including uploading/downloading files and pivoting.

To learn more, check out Day 9.

Walkthrough

Q#1: Deploy the attached VM, and wait a few minutes. What ports are open?

nmap -T4 -A -Pn 10.10.129.42

Q#2: What framework is the web application developed with?

After loading the web application in our browser at http://10.10.129.42:80 (use Firefox on the Kali web-Machine) and inspecting the wappalyzer extension.

Answer: Laravel

Q#3: What CVE is the application vulnerable to?

None 
Answer: CVE-2021-3129

Q#4: What command can be used to upgrade the last opened session to a Meterpreter session?

None 
Answer: session -u -1

Q#5: What file indicates a session has been opened within a Docker container?

Answer: /.dockerenv

Q#6: What file often contains useful credentials for web applications?

By reading the .env file in the session, we've found credentials for the web applications.

None 
Answer: .env

Q#7: What database table contains useful credentials?

Answer: users

Q#8: What is Santa's password?

Answer: p4$$w0rd

Q#9: What ports are open on the host machine?

To further pivot through the private network, we can create a socks proxy within Metasploit:

use auxiliary/server/socks_proxy
run srvhost=127.0.0.1 srvport=9050 version=4a

This will expose a port on the attacker machine that you can use to run other network tools through, such as curl or proxychains

curl --proxy socks4a://localhost:9050 http://172.17.0.1 -v
proxychains -q nmap -n -sT -Pn -p 22,80,443,5432 172.17.0.1
Answer: 22,80

Q#10: What is the root flag?

With the host scanned, we can see that port 22 is open on the host machine. It also is possible that Santa has re-used his password, and it's possible to SSH into the host machine from the Docker container to grab the flag:

None None 
Answer: THM{47C61A0FA8738BA77308A8A600F88E4B}

Day 9 is done! You might want to take a well-deserved rest now. If this challenge was right up your alley, though, we think you might enjoy the Compromising Active Directory module!

Conclusion

We worked with Metasploit and pivoting was fun. We learned about dockers and their vulnerability. We learned how to establish a Metasploit session and deploy a reverse shell (RCE) on the target system. We also learned how to pivot to other systems and leverage our access. Congrats on finishing the 9th day! I hope you found the walkthrough and task exciting. For Day 10, click here.