Planning
Machine information:
As is common in real life pentests, you will start the Planning box with credentials for the following account: admin / 0D5oT70Fq13EvB5r
Nmap results:
I tried Directory/Path fuzzing first with ffuf with no results. Switched to some subdomain fuzzing and got a hit for grafana!
The credentials you got in the beginning works here so you can log in as admin.
The version is Grafana v11.0.0 and I found this GitHub repository regarding a vulnerability in Grafana v11.0.0. Using this script gives us a reverse shell.
After looking around for a while I checked the environment variables and found this. Looks like a containerized environment. But there's credentials we could try SSH'ing with to escape the container.
We have a user and password which we can log in with.
I actually found the root flag in '/tmp/root.txt' but I'm guessing this is a misconfiguration since there is a root.txt in /home/enzo which only root can read.
I downloaded linpeas to the VM and ran it.
I looked at these files and in /opt/crontabs/crontab.db there were root credentials. These didn't work for SSH'ing though so it's credentials for something else.
Linpeas also showed that were listening on a few ports that might be worth checking out:
Let's set up SSH Local Port Forwarding
We can then browse to 127.0.0.1:8000 and enter the credentials. We're presented with a Crontab UI.
From here we can create a cronjob that 'cats' the root flag into a new file which we can read. I'm guessing the flag I found first was a remnant of someone else who did this.
Last updated