# \[Day 9] Pivoting

This challenge was certainly the most complex out of the entire room. The general objectives were to exploit a vulnerable machine and pivot to a docker container to exfiltrate data.

I first enumerated my target with nmap and found some framework information on the webpage. This led me to a vulnerability I could exploit. Once I knew my exploit I could use it with the Metasploit framework.

I was required by THM to use meterpreter and Metasploit for this challenge. Something I did not know is that when pivoting, meterpreter can find IP addresses for the routing tables

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FMnJ39vu5mTgTIL4ckOOs%2Fimage.png?alt=media\&token=3852acf0-1769-425d-b633-4da33cd3bfb4)

Combining this information and the .env information, I am able to add the proper routing table to my meterpreter session.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FrEZeUM2TQ68hld1l0UK8%2Fimage.png?alt=media\&token=578b1125-1cae-4e7e-82c3-97b6133fe8bc)

Once I knew what my targets were, I could begin exfiltrating database information.

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2Fayy2uWFw1SlLRgLbVxwh%2Fimage.png?alt=media\&token=2740c98f-04a2-49b1-975c-7e521432ada3)

I would use these credentials to ssh in and receive the root flag.&#x20;

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2FkHHomQyOT73Hpm3u4DrL%2Fimage.png?alt=media\&token=8fc080ab-1480-4601-a7f5-1d32e71cfed7)

## Flags

### Deploy the attached VM, and wait a few minutes. What ports are open?

80

### What framework is the web application developed with?

Laravel

### What CVE is the application vulnerable to?

cve-2021-3129

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2Ftsv6iVEzGtLp0rlsLo4V%2Fimage.png?alt=media\&token=8451c5ce-5ab8-4b9d-ab9b-a2f52643eb5f)

### What command can be used to upgrade the last opened session to a Meterpreter session?

sessions -u -1

### What file indicates a session has been opened within a Docker container?

/.dockerenv

### What file often contains useful credentials for web applications?

.env

![](https://850580359-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FSqAgfe92W3tM8LBhIHHu%2Fuploads%2F7xfA2Xu5GhO4JmscWv89%2Fimage.png?alt=media\&token=9da6cb65-011b-4820-8a0f-a727151b839c)

### What database table contains useful credentials?

users

### What is Santa's password?

p4$$w0rd

### What ports are open on the host machine?

22,80

### What is the root flag?

THM{47C61A0FA8738BA77308A8A600F88E4B}
