MonitorsTwo
#Linux #Enumeration #Docker
This is a easy difficulty Linux machine from HackTheBox created by TheCyberGeek. In this scenario, my IP is 10.10.14.32 and the target’s IP is 10.129.198.242
This machine was pretty funny; it is straightforward if you ignore the amount of noise if you fuzz the target. It has a proper amount of research once you interact with the target. Furthermore, when you are inside, the machine is designed to be an introduction to escape from Docker Containers. The only weird thing is the privilege scalation because the source of the information was well hidden.
Recon
The first steps are about getting basic information about the target, by using nmap and searching information from the website.
ping -c 1 10.129.198.242
Pinging 10.129.198.242 with 32 bytes of data:
Reply from 10.129.198.242: bytes=32 time=169ms TTL=63
Reply from 10.129.198.242: bytes=32 time=156ms TTL=63
Reply from 10.129.198.242: bytes=32 time=165ms TTL=63
Reply from 10.129.198.242: bytes=32 time=189ms TTL=63
Ping statistics for 10.129.198.242:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 156ms, Maximum = 189ms, Average = 169msThe machine is alive, and by the TTL (close to 64) we can assume and confirm that is definitely a Linux Machine
nmap -p- --open -sS --min-rate 5000 -vvv -n 10.129.198.242 -oG Ports
Completed SYN Stealth Scan at 10:09, 16.37s elapsed (65535 total ports)
Nmap scan report for 10.129.198.242
Host is up, received echo-reply ttl 63 (0.18s latency).
Scanned at 2023-05-25 10:09:29 Pacific SA Standard Time for 17s
Not shown: 65391 closed tcp ports (reset), 142 filtered tcp ports (no-response)
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63By searching "OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 launchpad" in google, we find that our target is a Linux-Focal machine, is good to know every detail about the target... and the other information to the pocket, is that the port 80 use nginx/1.18.0.
Browser: http://10.129.198.242/
At the view:source there is a lot of information at the login page, another detail, the site redirect us to a index.php, we can use FUZZ with php too.
I went to LICENSE and CHANGELOG, there is nothing interesting there, the other sites are errors or they redirect you to index.php.
Exploit
Reverse Shell [www-data]
After some recon at some of the found websites, an option was to search for exploit for each framework version, and if you search for "Cacti 1.2.22 exploit" there is something, CVE-2022-46169, RCE.
Download the python script, looks like an script to make a connection to a listening port, so here you need two local terminals.
Leave Docker Container
And we are in, our Local Terminal A is now [www-data]
Now to work properly we need to upgrade the bash.
Uh... the machine is called "MonitorsTwo", it's no surprise that involve a Docker.
Wow, there is a lot of stuff,
By using this, I only find configuration and code, nothing about plain text credentials, but when I went to /, there is a file called entrypoint.sh... with sql credentials in plain text.
Database exploration
Reverse Shell [marcus]
And we find two credentials, I went to CrackStation, in HackTheBox is common to use frequent hashes, but this is not the case, so it's time to use John the Ripper.
Privilege Escalation
Now we are inside the machine
Nothing suspicious, we can check some process then.
And now the grep cycle at /
At /var/mail/marcus there is something relevant, the first two vulnerabilities are not interesting, but the third one it is.
After reading a little bit, first we need to be root at the Docker Container.
It did not work, but at least we find the vulnerable docker. So, by coincidence it's the first docker that we attacked.
Exploiting CVE-2021-41091
Now that the docker's bash is usable to everyone, we return to the other terminal with the user marcus, and then execute that bash.
Last updated