Page cover

Couch (CouchDB, Docker)

Firstly, we need to enumerate using rustscan and nmap.

$ rustscan -a 10.10.81.117 | tee rust.log
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy           :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan

[~] The config file is expected to be at "/home/hnl/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.81.117:22
Open 10.10.81.117:5984


$ nmap -A -p22,5984 10.10.81.117 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-27 08:43 +0630
Nmap scan report for 10.10.81.117
Host is up (0.31s latency).

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 34:9d:39:09:34:30:4b:3d:a7:1e:df:eb:a3:b0:e5:aa (RSA)
|   256 a4:2e:ef:3a:84:5d:21:1b:b9:d4:26:13:a5:2d:df:19 (ECDSA)
|_  256 e1:6d:4d:fd:c8:00:8e:86:c2:13:2d:c7:ad:85:13:9c (ED25519)
5984/tcp open  http    CouchDB httpd 1.6.1 (Erlang OTP/18)
|_http-server-header: CouchDB/1.6.1 (Erlang OTP/18)
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.11 seconds

Port 5984 is CouchDB httpd 1.6.1. Let's Check what's that. Here is a result when I browser to couchDB port.

When you browser to http://10.10.81.117:5984/_utils/, you will see some databases.

At secret database http://10.10.81.117:5984/_utils/document.html?secret/a1320dd69fb4570d0a3d26df4e000be7, you will find some credential to login via ssh.

Let's login with this credential.

With history command, you will find some interesting docker command.

Easily found root.txt on this box.

Last updated

Was this helpful?