Fantastic

Gaining Access

Nmap scan:

$ nmap -p- --min-rate 3000 -Pn 192.168.208.181                       
Starting Nmap 7.93 ( https://nmap.org ) at 2023-07-21 16:49 +08
Warning: 192.168.208.181 giving up on port because retransmission cap hit (10).
Nmap scan report for 192.168.208.181
Host is up (0.18s latency).
Not shown: 65412 closed tcp ports (conn-refused), 121 filtered tcp ports (no-response)
PORT     STATE SERVICE
22/tcp   open  ssh
3000/tcp open  ppp

Grafana LFI + Decrypt Password -> SSH Creds

Port 3000 was running Grafana:

This particular version had an LFI exploit:

I verified that it works:

Since we don't have Grafana credentials, let's try to read it at /etc/grafana/grafana.ini. I found this within the configuration files:

We can attempt to read the Grafana database from that folder. I copied the output to a file, and checked for instances of admin:

I also found this within it:

This was an encoded password. Googling how to decrypt this led me to another Github repository:

LogoGitHub - jas502n/Grafana-CVE-2021-43798: Grafana Unauthorized arbitrary file reading vulnerabilityGitHub

To abuse this, replace the secret Key and encrypted password within the script:

Afterwards, make sure that go has the golang.org/x/crypto/pbkdf2@latest module installed. This would let us decrypt the password:

With the password, I tested Grafana and SSH, and it worked for the sysadmin user:

Privilege Escalation

Disk Group -> Read SSH Key

We are part of the disk group, meaning we actually have full access to the file system through debugfs. First, let's check the different devices available:

/dev/sda2 is obviously the main file system. We can then grab the root user's private SSH key:

Then, we can ssh in as root:

PreviousFailNextFlasky

Last updated