Ready_Lateral_Movement

root

---

Upon gaining a foothold, I quickly realized that I am inside a Docker container. I started by enumerating the container filesystem and came across the Docker configuration file and GitLab configuration files. They gave me an insight over the environment.

Additionally, while what appeared to be a credential found to be negative for password reuse, the other credential also has to be tested for password reuse. The other CLEARTEXT credential was configured to be a password to authenticate to the SMTP server for the gitlab_rails instance

git@gitlab:/opt/backup$ su root
password: wW59U!ZKMbG9+*#h
 
root@gitlab:/opt/backup# whoami
root
root@gitlab:/opt/backup# hostname
gitlab.example.com

Password reuse is confirmed for the root user Lateral Movement made to the root user inside the Docker container