Couch (CouchDB, Docker)
Firstly, we need to enumerate using rustscan and nmap.
$ rustscan -a 10.10.81.117 | tee rust.log
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: https://discord.gg/GFrQsGy :
: https://github.com/RustScan/RustScan :
--------------------------------------
Please contribute more quotes to our GitHub https://github.com/rustscan/rustscan
[~] The config file is expected to be at "/home/hnl/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.81.117:22
Open 10.10.81.117:5984
$ nmap -A -p22,5984 10.10.81.117 | tee nmap.log
Starting Nmap 7.80 ( https://nmap.org ) at 2022-01-27 08:43 +0630
Nmap scan report for 10.10.81.117
Host is up (0.31s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 2048 34:9d:39:09:34:30:4b:3d:a7:1e:df:eb:a3:b0:e5:aa (RSA)
| 256 a4:2e:ef:3a:84:5d:21:1b:b9:d4:26:13:a5:2d:df:19 (ECDSA)
|_ 256 e1:6d:4d:fd:c8:00:8e:86:c2:13:2d:c7:ad:85:13:9c (ED25519)
5984/tcp open http CouchDB httpd 1.6.1 (Erlang OTP/18)
|_http-server-header: CouchDB/1.6.1 (Erlang OTP/18)
|_http-title: Site doesn't have a title (text/plain; charset=utf-8).
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 31.11 seconds
Port 5984 is CouchDB httpd 1.6.1. Let's Check what's that. Here is a result when I browser to couchDB port.

When you browser to http://10.10.81.117:5984/_utils/, you will see some databases.

At secret database http://10.10.81.117:5984/_utils/document.html?secret/a1320dd69fb4570d0a3d26df4e000be7, you will find some credential to login via ssh.

Let's login with this credential.

With history command, you will find some interesting docker command.

Easily found root.txt on this box.

Last updated
Was this helpful?