Discovery of Vulnerable Machines While investigating vulnerable, internet-facing systems, I successfully compromised several devices. Although the specific techniques I used to gain initial access fall outside the scope of this post, the real discovery came during my post-exploitation phase on one of the compromised machines. Discovering Vulnerable SSH Configurations While reviewing the files on the compromised system, I stumbled upon something interesting in the ~/.ssh directory of a particular user account. Within this directory, I found a private key file being used for SSH logins to other systems. My next step was to check whether the private key was encrypted. ...

Understanding Lateral Movement Lateral movement in cybersecurity refers to the techniques used by attackers to move within a compromised network after gaining initial access. This allows them to escalate privileges, exfiltrate data, and reach high-value targets while evading detection. Advanced Persistent Threats (APTs) commonly use this tactic to maintain long-term access, often remaining undetected for extended periods. Entry Point During my exploration of vulnerable and misconfigured internet-facing machines, I was able to gain root access to several devices. The methods I used to gain initial access are beyond the scope of this blog. While analyzing one of the compromised machines during post-exploitation, I noticed in the bash history that the user frequently connected to other devices via SSH. This discovery led me to investigate further, with the goal of capturing credentials to access additional systems. ...

SSH Services at IIT Kanpur IIT Kanpur’s network uses Class B private IP addresses. Within this private network, students, faculty and staff can SSH into various servers using their Computer Center credentials to access different services. Examples of such servers include the GPU server, APP server, and MATH server. Each user has a 2GB directory on the Computer Center’s NFS (Network File System), which is mounted on all servers. This allows users to access their files across multiple servers without needing to copy them to each one, reducing the need for additional storage on individual servers. ...

Prologue While exploring devices on my college network, I managed to gain Remote Desktop Access to a server for one of our institute’s websites. The method I used to obtain access to the interface is out of the scope of this blog. Upon gaining access, I found that the server was running Ubuntu. The terminal displayed user as the current user. I added my public key to /home/user/.ssh/authorized_keys and checked the SSH connection. With SSH access confirmed, it was time to escalate our privileges to the root user. ...

Portainer Portainer is an open-source management tool designed for containers. It offers a user-friendly, lightweight web interface that simplifies the deployment and management of Docker environments. It’s important to note that while Portainer itself does not run with root privileges, if the Docker service managed by Portainer operates with root permissions, it could potentially lead to a remote root shell vulnerability, as discussed further. Information Gathering Collecting Target Devices We’ll use Shodan Search Engine to Collect Target Devices. On Shodan Search Engine search with query product:portainer, this would list out all the Devices that were identified running Portainer by Shodan. After setting the requeired filters, we can download the results. The Number of Results that can be downloaded depends upon your query credits available(1 Query Credit = 100 Results) After Shodan has done compiling the data, it sends us a Mail that Data is ready for Download or we can alernatively wait on Shodan Download Page while the data is being compiled The Download will be in the format .json.gz. Shodan provides a Command-Line Utility to Parse the data in these download files. The utility can be installed with the command ...