[Detector6]

sure. my pleasure
As for root, port 5000 is exposed for docker 172.17.0.2
it has changedetection.io installed, tried a couple of exploits but nothing. Anyone got anything?

That is a good find, nice one. netstat and ss didn't show anything as user james, how did you find the ip and port 5000?

ligolo-ng to get at the container

Then nmap the 172 subnet? I guess Chisel would work here as well.
Thanks!

[cutearmadillo]

Can someone explain how did you find the ip and port?

You can see docker running (like in the ps output), then you check the interface for the IP and find 172.17.0.1.
Either use nmap or ping + nc to find the IP of the container and the port

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[peRd1]

Can someone explain how did you find the ip and port?

Ping sweeping. You can see even with `ip a` or `ifconfig` the docker that there's something off. 
Linpeas and pspy64 also you could see related to changedetection io website. Then you can investigate.

Also, let's not forget the name of this box, we all got tricked, by the docker, by the freaking slicer, and the badly written POC for foothold etc.
Then again, probably box was changed during approval/publish/etc, since adam should be the the intended path, prunaslicer can be run with sudo, so yeah. James > lateral to Adam > root.
It also doesn't make a sense leaving the root pwd accidentally in the bash history which match also adam's creds  not just the host.
And this cred should have been found from the backup zip from datastores I'd say... not the history. 

But this time, the name checks out - trickster.

[jsvensson]

Ach i can't get shell to docker, using notifications nothing works even added login to exploit.

Finally got it

[idontevensmokebro]

Ach i can't get shell to docker, using notifications nothing works even added login to exploit.

To get shell on docker you need to use correct `notification url` like `get://SERVER` (gets didnt work). I think only criteria is that server has to be accessible and also change reddit urls to something accessible on network. After adding watcher update server with new file and that should trigger the SSTI. (If it doesn't you can manually do it)

Notification url formats are found in watcher instance tabs.

[Unbutton8074]

Were you able to crack adams hash?

I cracked james' hash from the database

---

for POC
there is a couple of things to change:
in zip you have a.php - need a change to yours ip to get shell - but this file must be in zip
in exploit.py - change name of shell.php to /themes/next/a.php
in exploit html:
all admin-dev to admin634ewutrx1jgitlooaj
and in import_theme to yours_ip

I had to change the call to reverse_shell.php in exploit.html to a.php as well
(or you can add the modified reverse_shell.php to the zip)

no need to modify reverse_shell.php actually, just modify a.php inside zip

[jsvensson]

Ach i can't get shell to docker, using notifications nothing works even added login to exploit.

To get shell on docker you need to use correct `notification url` like `get://SERVER` (gets didnt work). I think only criteria is that server has to be accessible and also change reddit urls to something accessible on network. After adding watcher update server with new file and that should trigger the SSTI. (If it doesn't you can manually do it)

Notification url formats are found in watcher instance tabs.

I had to manually trigger notification and then it worked

[mrdot457]

guys, how did you find the port 5000 is open?

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Spamming | https://breachforums.ai/Forum-Ban-Appeals if you feel this is incorrect.

[cutearmadillo]

guys, how did you find the port 5000 is open?

nc -zv 172.17.0.2 1-10000 2>&1 | grep -v "Connection refused"

Connection to 172.17.0.2 5000 port [tcp/*] succeeded!

This forum account is currently banned. Ban Length: Permanent (N/A Remaining)
Ban Reason: Leeching.

[Str4ngerX]

for POC
there is a couple of things to change:
in zip you have a.php - need a change to yours ip to get shell - but this file must be in zip
in exploit.py - change name of shell.php to /themes/next/a.php
in exploit html:
all admin-dev to admin634ewutrx1jgitlooaj
and in import_theme to yours_ip

I'm still unable to get this working, I'm not able to GET http://shop.trickster.htb/themes/next/a.php, it says forbidden.
I have a.php exploit.html exploit.py ps_next_8_theme_malicious.zip (i've added my ip to a.php inside the zip)

I've made the right modifications but still nothing can't GET that a.php, I'm recieving GET requests at my hosted python web server and it's GETing that zip file successfully.

Any help please?