search
Notes - OSCP

Fanatastic

Grafana disk

  • Nom machine : Fanatastic

  • Difficulté : Facile

  • OS : Linux

hashtag
Enumération

hashtag
NMAP

Nmap scan report for 192.168.205.181
Host is up (0.033s latency).
Not shown: 65455 closed tcp ports (conn-refused), 77 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 c1:99:4b:95:22:25:ed:0f:85:20:d3:63:b4:48:bb:cf (RSA)
|   256 0f:44:8b:ad:ad:95:b8:22:6a:f0:36:ac:19:d0:0e:f3 (ECDSA)
|_  256 32:e1:2a:6c:cc:7c:e6:3e:23:f4:80:8d:33:ce:9b:3a (ED25519)
3000/tcp open  ppp?
| fingerprint-strings: 
|   GenericLines, Help, Kerberos, RTSPRequest, SSLSessionReq, TLSSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 302 Found
|     Cache-Control: no-cache
|     Content-Type: text/html; charset=utf-8
|     Expires: -1
|     Location: /login
|     Pragma: no-cache
|     Set-Cookie: redirect_to=%2F; Path=/; HttpOnly; SameSite=Lax
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: deny
|     X-Xss-Protection: 1; mode=block
|     Date: Fri, 22 Nov 2024 13:25:56 GMT
|     Content-Length: 29
|     href="/login">Found</a>.
|   HTTPOptions: 
|     HTTP/1.0 302 Found
|     Cache-Control: no-cache
|     Expires: -1
|     Location: /login
|     Pragma: no-cache
|     Set-Cookie: redirect_to=%2F; Path=/; HttpOnly; SameSite=Lax
|     X-Content-Type-Options: nosniff
|     X-Frame-Options: deny
|     X-Xss-Protection: 1; mode=block
|     Date: Fri, 22 Nov 2024 13:26:01 GMT
|_    Content-Length: 0
9090/tcp open  http    Golang net/http server (Go-IPFS json-rpc or InfluxDB API)
| http-title: Prometheus Time Series Collection and Processing Server
|_Requested resource was /graph
| http-methods: 
|_  Supported Methods: GET OPTIONS
|_http-favicon: Unknown favicon MD5: 5EE43B38986A144D6B5022EA8C8F748F

hashtag
Accès initial

On remarque qu'au port 3000 Grafana tourne, en bas à gauche on remarque sn numéro de version.

LogoGrafana 8.3.0 - Directory Traversal and Arbitrary File ReadExploit Databasechevron-right

Ceci était possible à exploiter manuellement dans Burp Suite.

LogoGitHub - jas502n/Grafana-CVE-2021-43798: Grafana Unauthorized arbitrary file reading vulnerabilityGitHubchevron-right

Nous avons récupéré notamment deux fichiers intéressants : grafana.ini et grafana.db (dernier ouvrable dans SQLite).

LogoLinux Exploitation | VK9 Securityvk9-sec.comchevron-right

secret_key : SW2YcwTIb9zpOOhoPsMm password hash : anBneWFNQ2z+IDGhz3a7wxaqjimuglSXTeMvhbvsveZwVzreNJSw+hsV4w==

Nous pouvons utiliser ce script :

https://github.com/jas502n/Grafana-CVE-2021-43798

LogoGitHub - jas502n/Grafana-CVE-2021-43798: Grafana Unauthorized arbitrary file reading vulnerabilityGitHubchevron-right

Nous obtenons le password : SuperSecureP@ssw0rd

hashtag
Elévation des privilèges

LogoDisk Group Privilege EscalationHacking Articleschevron-right
PrécédentExfiltratedSuivantFired

Mis à jour