search

MonitorsTwo

#Linux #Enumeration #Docker

This is a easy difficulty Linux machine from HackTheBox arrow-up-rightcreated by TheCyberGeek. In this scenario, my IP is 10.10.14.32 and the target’s IP is 10.129.198.242

This machine was pretty funny; it is straightforward if you ignore the amount of noise if you fuzz the target. It has a proper amount of research once you interact with the target. Furthermore, when you are inside, the machine is designed to be an introduction to escape from Docker Containers. The only weird thing is the privilege scalation because the source of the information was well hidden.

hashtag
Recon

The first steps are about getting basic information about the target, by using nmap and searching information from the website.

Local Terminal
ping -c 1 10.129.198.242

Pinging 10.129.198.242 with 32 bytes of data:
Reply from 10.129.198.242: bytes=32 time=169ms TTL=63
Reply from 10.129.198.242: bytes=32 time=156ms TTL=63
Reply from 10.129.198.242: bytes=32 time=165ms TTL=63
Reply from 10.129.198.242: bytes=32 time=189ms TTL=63

Ping statistics for 10.129.198.242:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 156ms, Maximum = 189ms, Average = 169ms

The machine is alive, and by the TTL (close to 64) we can assume and confirm that is definitely a Linux Machine

Local Terminal
nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.198.242 -oG Ports

Completed SYN Stealth Scan at 10:09, 16.37s elapsed (65535 total ports)
Nmap scan report for 10.129.198.242
Host is up, received echo-reply ttl 63 (0.18s latency).
Scanned at 2023-05-25 10:09:29 Pacific SA Standard Time for 17s
Not shown: 65391 closed tcp ports (reset), 142 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE REASON
22/tcp open  ssh     syn-ack ttl 63
80/tcp open  http    syn-ack ttl 63

By searching "OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 launchpad" in google, we find that our target is a Linux-Focal machine, is good to know every detail about the target... and the other information to the pocket, is that the port 80 use nginx/1.18.0.

[+] Data : Cacti version 1.2.22

At the view:source there is a lot of information at the login page, another detail, the site redirect us to a index.php, we can use FUZZ with php too.

I went to LICENSE and CHANGELOG, there is nothing interesting there, the other sites are errors or they redirect you to index.php.

hashtag
Exploit

hashtag
Reverse Shell [www-data]

After some recon at some of the found websites, an option was to search for exploit for each framework version, and if you search for "Cacti 1.2.22 exploit" there is something, CVE-2022-46169, RCE.

LogoGitHub - FredBrave/CVE-2022-46169-CACTI-1.2.22: This is a exploit of CVE-2022-46169 to cacti 1.2.22. This exploit allows through an RCE to obtain a reverse shell on your computer.GitHubchevron-right

Download the python script, looks like an script to make a connection to a listening port, so here you need two local terminals.

hashtag
Leave Docker Container

And we are in, our Local Terminal A is now [www-data]

Now to work properly we need to upgrade the bash.

Uh... the machine is called "MonitorsTwo", it's no surprise that involve a Docker.

Wow, there is a lot of stuff,

By using this, I only find configuration and code, nothing about plain text credentials, but when I went to /, there is a file called entrypoint.sh... with sql credentials in plain text.

hashtag
Database exploration

hashtag
Reverse Shell [marcus]

And we find two credentials, I went to CrackStationarrow-up-right, in HackTheBox is common to use frequent hashes, but this is not the case, so it's time to use John the Ripper.

hashtag
Privilege Escalation

Now we are inside the machine

Nothing suspicious, we can check some process then.

And now the grep cycle at /

At /var/mail/marcus there is something relevant, the first two vulnerabilities are not interesting, but the third one it is.

LogoGitHub - UncleJ4ck/CVE-2021-41091: POC for CVE-2021-41091GitHubchevron-right

After reading a little bit, first we need to be root at the Docker Container.

It did not work, but at least we find the vulnerable docker. So, by coincidence it's the first docker that we attacked.

hashtag
Exploiting CVE-2021-41091

Logocapsh | GTFOBinsgtfobins.github.iochevron-right

Now that the docker's bash is usable to everyone, we return to the other terminal with the user marcus, and then execute that bash.

PreviousPreciousNextSau

Last updated