Data — HTB Writeup | The Hack Sparrow

Executive summary — Data is an Easy Linux box that mirrors a very realistic scenario: a Grafana v8.0.0 panel exposed on port 3000 is vulnerable to CVE-2021-43798, an unauthenticated path traversal / LFI. With it we exfiltrate Grafana's SQLite database (grafana.db), crack boris's PBKDF2-HMAC-SHA256 hash and SSH in. Once inside, sudo -l reveals a NOPASSWD entry on docker exec: dropping into a running container as root with --privileged lets us mount the host disk and fully escape the container. Path: Grafana LFI -> grafana.db -> boris -> sudo docker exec --privileged -> mount the host -> root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.234.47`

Attack map

[3000] Grafana v8.0.0 -> CVE-2021-43798 (path traversal / LFI)
   |  read /var/lib/grafana/grafana.db (SQLite)
   v
[HASH] boris (PBKDF2-HMAC-SHA256) -> cracked -> beautiful1
   |
   v
[SSH]  boris : beautiful1  (user.txt)
   |  sudo -l -> NOPASSWD: /snap/bin/docker exec *
   v
[DOCKER] exec -it --privileged --user root <container> bash
   |  inside, privileged: mount /dev/sda1 /mnt
   v
[ROOT] host disk mounted at /mnt (root.txt + sudoers)

1. Reconnaissance

Before touching anything: a full port sweep, then a version/script scan against whatever is open, so we don't miss a service sitting on a high port.

nmap -p- --min-rate 10000 10.129.234.47 -oN scan.txt
nmap -p22,3000 -sCV 10.129.234.47 -oN scan_services.txt

Port	Service	Detail
22	SSH	OpenSSH 7.6
3000	HTTP	Grafana

Two useful clues from the first scan already: the response's TTL differs from what a plain Linux host usually shows, which often gives away that the service is running inside a container; and port 3000 (instead of the usual 80/443) signals the web app as the main vector, while SSH is left for later, once we have credentials.

Resumen ejecutivo — Data es un Linux Easy que reproduce un escenario muy realista: un panel de Grafana v8.0.0 expuesto en el puerto 3000 es vulnerable a CVE-2021-43798, un path traversal / LFI sin autenticacion. Con el exfiltramos la base SQLite de Grafana (grafana.db), crackeamos el hash PBKDF2-HMAC-SHA256 de boris y entramos por SSH. Una vez dentro, sudo -l revela un NOPASSWD sobre docker exec: metiendonos en un contenedor existente como root y con --privileged podemos montar el disco del host y escapar del contenedor por completo. Recorrido Grafana LFI -> grafana.db -> boris -> sudo docker exec --privileged -> mount del host -> root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.234.47`

Mapa del ataque

[3000] Grafana v8.0.0 -> CVE-2021-43798 (path traversal / LFI)
   |  leer /var/lib/grafana/grafana.db (SQLite)
   v
[HASH] boris (PBKDF2-HMAC-SHA256) -> crackeado -> beautiful1
   |
   v
[SSH]  boris : beautiful1  (user.txt)
   |  sudo -l -> NOPASSWD: /snap/bin/docker exec *
   v
[DOCKER] exec -it --privileged --user root <contenedor> bash
   |  dentro, privilegiado: mount /dev/sda1 /mnt
   v
[ROOT] disco del host montado en /mnt (root.txt + sudoers)

1. Reconocimiento

Antes de tocar nada, un barrido completo de puertos y luego un escaneo de version/scripts sobre lo que este abierto: asi no nos dejamos servicios en puertos altos.

nmap -p- --min-rate 10000 10.129.234.47 -oN scan.txt
nmap -p22,3000 -sCV 10.129.234.47 -oN scan_services.txt

Puerto	Servicio	Detalle
22	SSH	OpenSSH 7.6
3000	HTTP	Grafana

Dos pistas importantes desde el primer escaneo: el TTL de la respuesta es distinto del tipico de un host Linux normal, lo que suele delatar que el servicio corre dentro de un contenedor; y el puerto 3000 (no el 80/443 habitual) apunta a que la web es el vector principal, mientras que SSH quedara para el acceso posterior una vez tengamos credenciales.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.