Data - Hack The Box
Enumeration
Nmap
Initial nmap scan revealed Port 3000 and Port 22 (SSH) were open.
Web Enumeration
Visiting the port 3000 revealed a grafana website.
Later, I checked grafana version and found out it was vulnerable to Path Traversal.
Exploitation
CVE-2021-43798
Searching through the internet, I found the config file location of grafana. It included secret_key and other informations. At first I tried to decrypt datasource password but I could not.
Then further enumeration revealed sqlite db named grafana.db.
I downloaded it using curl. After the download, I enumerated the sqlite db and found salted hashes on the database.
Using the grafana2hashcat tool, I generated cracable password format, then run hashcat using rockyour.txt file.
The hash of the boris was cracked.
I logged in and got the user flag.
Privilege Escalation
The “sudo -l” command revealed I can run “docker exec” command as sudo.
To run it I need to find the container id or container name. I could not run docker ps or docker container ls. So at first I tried random names and one of the names were true: “grafana”.
However, it is not a dependable solution. So I tried another method, I checked running processes and grepped docker. This revealed the container id.
After learning the container id, I checked for mounts on the current machine. The /dev/sda1 mount was on the / path.
Thus, with the container id I got a root shell on the container. Then mounted the /dev/sda1 to access to host machines root folder and got the root flag.
Pwned
The machine was pwned.