Sink
Enumeration
Ports and Services
Software Installed:
Nmap Scan Results:
During standard gobuster scan the site blocked me for a few minutes. No
further scans being conducted
Port 5000:
Registered and loggedin:
Under Reach Us is possible username.
Headers show gunicorn 20.0.0
Vuln: https://snyk.io/vuln/SNYK-PYTHON-GUNICORN-541164
Modified Request Post request on comment form:
Resource: https://nathandavison.com/blog/haproxy-http-request-smuggling
Retrieved an admin cookie:
Replaced my session cookie with that of one in comments and was logged in as
Admin
Notes
Note 1
Chef Login : http://chef.sink.htb Username : chefadm Password :
/6’fEGC&zEx{4]zz
Note 2
Dev Node URL : http://code.sink.htb Username : root Password :
FaH@3L>Z3})zzfQ3
Note 3:
Nagios URL : https://nagios.sink.htb Username : nagios_adm Password :
g8<H6GK\{*L.fB3C
Port 3000 is a gitea repo
Logged in with found root creds. Browsing the Key_Management project commits
found a OpenSSH Private Key.
There is also a key and secret in the Log_Management repo:
http://10.129.71.3:3000/root/Log_Management/commit/bee2670414f70e0f34f59b6695e9e19b32c2215d
User.txt Proof Screenshot
User.txt Contents
18b01f0574945103649365abbd9aab86
##
Privilege Escalation
Useful Software
Looking at AWS.
Port found in Log Management seems to be running as root
Used aws to list secrets (you must configure first. Use the keys found in
Log_Management)
Retrieved some user passwords:
Command: aws –endpoint-url=”http://127.0.0.1:4566” secretsmanager get-secret-
value –secret-id ‘'
arn:aws:secretsmanager:us-east-1:1234567890:secret:Jenkins Login-GCrPv
arn:aws:secretsmanager:us-east-1:1234567890:secret:Sink Panel-QMxtX
arn:aws:secretsmanager:us-east-1:1234567890:secret:Jira Support-ouXZJ
Tried Davids password and it is re-used:
SSH doesn’t seem to work
Listed all encryptions keys
aws –endpoint-url=”http://127.0.0.1:4566/” kms list-keys
Most keys were disabled. Enabled all the keys:
CMD: aws –endpoint-url=’http://127.0.0.1:4566’ kms enable-key –key-id
“"
Ran through all the keys to decrypt servers.enc:
CMD: aws –endpoint-url=’http://127.0.0.1:4566’ kms decrypt –key-id
“804125db-bdf1-465a-a058-07fc87c0fad0” --ciphertext-blob
“fileb:///home/david/Projects/Prod_Deployment/servers.enc” --encryption-
algorithm “RSAES_OAEP_SHA_256” --output “text” --query “Plaintext”
Not a text file:
Decoded file:
Renamed the file to the tarball extension and unzipped it
Contents of servers.yml:
The password is also the root password.
RootScreenshot Here:
Root.txt Contents:
1164841b85a3e4167f398b30980c0532