root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat cerberus.md
// writeups

Cerberus

18 Mar 2023 · 30 min read · root access
writeupshacktheboxwindowsHardretiredvip
Cerberus - maquina de Hack The Box

Executive summary — Cerberus models a realistic hybrid monitoring setup: a Linux virtual machine hosts Icinga Web 2 2.11.2, exposed externally only on port 8080, and that VM is joined to the cerberus.local domain whose Windows Domain Controller hosts it and also runs a ManageEngine ADSelfService Plus identity self-service portal reachable only from the host itself. The name isn't accidental: like the three-headed guardian, the box is cleared in three chained layers. An unauthenticated path traversal (CVE-2022-24716) leaks Icinga's configuration and a plaintext password; that account enables an authenticated RCE (CVE-2022-24715) via an SSH resource holding a PHP+PEM polyglot key; inside the VM, a vulnerable SUID firejail binary (CVE-2022-31214) grants local root; SSSD's offline cache stores a domain user's hash, crackable with rockyou, which is reused against the Domain Controller's WinRM for user.txt; and, with no local privilege escalation available on Windows, the only path left is ADSelfService Plus, whose SAML endpoint only listens on 127.0.0.1:9251 — reachable only by standing up a reverse SOCKS tunnel with chisel from the DC itself, to fire a preauthenticated RCE against it as NT AUTHORITY\SYSTEM (CVE-2022-47966).

PlatformHack The Box
Operating systemUbuntu 22.04 (Icinga VM) domain-joined to a Windows Server (Domain Controller for cerberus.local)
DifficultyHard
StatusRetired
Target IP10.129.232.100

Attack map

[8080/HTTP] icinga.cerberus.local -- path traversal (CVE-2022-24716) -> authentication.ini
   |  plaintext credential: matthew : IcingaWebPassword2023
   v
[Icinga Web 2] SSH resource -- PHP+PEM polyglot key (CVE-2022-24715) -> malicious module
   |  authenticated RCE as www-data
   v
[SUID] firejail --join (CVE-2022-31214) -- namespace TOCTOU -> root@icinga (VM)
   |  SSSD offline cache -> matthew SHA-512 hash -> hashcat -> 147258369
   v
[WinRM 5985] DC cerberus.local -- credential reuse (matthew) -> user.txt
   |  no local privesc -- only remaining service: ADSelfService Plus (:9251, 127.0.0.1 only)
   v
[chisel] reverse SOCKS via c.exe on the DC -- tunnel to 127.0.0.1:9251
   |  preauth SAML RCE (CVE-2022-47966, rt:exec XSLT transform)
   v
[SYSTEM] ManageEngine ADSelfService Plus -> root.txt

1. Reconnaissance

A full port scan shows a minimal surface: a single HTTP service.

nmap -p8080 -sCV -Pn -oN nmap-services.txt 10.129.232.100
PORT     STATE SERVICE VERSION
8080/tcp open  http    Apache httpd 2.4.52 ((Ubuntu))
|_http-open-proxy: Proxy might be redirecting requests
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://icinga.cerberus.local:8080/icingaweb2

The redirect gives away two things at once: the vhost icinga.cerberus.local and the app's base path, /icingaweb2. That a monitoring server is the only entry point, with nothing else exposed (no SSH, no SMB, not even the DC itself visible from outside), already hints that the entire first half of the chain has to run through Icinga.

echo "10.129.232.100 icinga.cerberus.local cerberus.local" | sudo tee -a /etc/hosts

Browsing to http://icinga.cerberus.local:8080/icingaweb2 brings up the Icinga Web 2 login. Versioned static assets served on the page (CSS/JS paths) pin down the exact branch as 2.11.x without any authentication — precisely the version affected by the pair of CVEs published in March 2022 that kicks off the whole intrusion.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.