Monitored — HTB Writeup | The Hack Sparrow

Executive summary — Monitored chains a public SNMP community with no view attached that leaks service credentials through the process table, an inconsistent authorization flaw in Nagios XI (the authentication API doesn't check the enabled flag that the web login does check), and CVE-2023-40931 — a time-based blind SQL injection — to steal nagiosadmin's API key, create an admin user and get RCE by abusing Nagios's own mechanisms (Manage Plugins + Core Config Manager). The final escalation reuses a sudo rule that starts the npcd daemon via systemd — the binary that service executes turns out to be writable by the very user granted that sudo.

Platform	Hack The Box
Operating system	Linux (Debian 11)
Difficulty	Medium
Status	Retired
Target IP	`10.129.56.190`

Attack map

[161/UDP] SNMP — "public" rocommunity with no view attached
   │  hrSWRunParameters leaks check_host.sh's cmdline:
   │  svc : XjH7VCehowpR1xZB
   ▼
[API] Nagios XI /api/v1/authenticate — does not check the "enabled" flag
   │  SSH and the web login reject svc; the API hands it a valid token
   ▼
[SQLi]  CVE-2023-40931 — banner_message-ajaxhelper.php, time-based blind
   │  extracts nagiosadmin's API key
   ▼
[ADMIN]  API creates an admin user -> Manage Plugins + CCM (check_local_users)
   │  RCE: own SSH key installed in /home/nagios/.ssh
   ▼
[SSH]  nagios  (user.txt)
   │  sudo NOPASSWD manage_services.sh start npcd -> systemd ExecStart
   │  /usr/local/nagios/bin/npcd is writable by nagios
   ▼
[ROOT]  swap npcd for a script -> systemd runs it as root -> SUID bash

1. Reconnaissance

1.1 TCP ports

sudo nmap -p- --min-rate 5000 -T4 -Pn -oN nmap_allports.txt 10.129.56.190
sudo nmap -p22,80,389,443,5667 -sCV -Pn -oN nmap_services.txt 10.129.56.190

22/tcp   open  ssh      OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
80/tcp   open  http     Apache httpd 2.4.56
|_http-title: Did not follow redirect to https://nagios.monitored.htb/
389/tcp  open  ldap     OpenLDAP 2.2.X - 2.3.X
443/tcp  open  ssl/http Apache httpd 2.4.56 ((Debian))
|_http-title: Nagios XI
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/
|                    stateOrProvinceName=Dorset/countryName=UK
5667/tcp open  tcpwrapped

The TLS certificate reveals the vhost nagios.monitored.htb. Port 5667 is NSCA (Nagios Service Check Acceptor) and 389 is LDAP: all consistent with a Nagios XI install.

echo "10.129.56.190 monitored.htb nagios.monitored.htb" | sudo tee -a /etc/hosts

1.2 The port that changes the game

With a monitoring server in front of you, UDP has to be scanned. SNMP is the monitoring protocol and lives on 161/udp: a TCP scan would never see it.

sudo nmap -sU --top-ports 50 --min-rate 2000 -Pn -oN nmap_udp.txt 10.129.56.190

PORT      STATE  SERVICE
123/udp   open   ntp
161/udp   open   snmp

Skipping the UDP scan is the most common mistake on monitoring boxes. Here, without 161, there is no way in.

Resumen ejecutivo — Monitored encadena una comunidad SNMP pública sin vista asociada que filtra credenciales de servicio a través de la tabla de procesos, una autorización inconsistente en Nagios XI (la API de autenticación no comprueba el flag enabled que sí valida el login web), y CVE-2023-40931 — una inyección SQL ciega por tiempo — para robar la API key de nagiosadmin, crear un usuario administrador y conseguir RCE abusando de los propios mecanismos de Nagios (Manage Plugins + Core Config Manager). La escalada final reutiliza una regla de sudo que arranca el demonio npcd vía systemd — el binario que ese servicio ejecuta resulta ser escribible por el propio usuario al que se concede el sudo.

Plataforma	Hack The Box
Sistema operativo	Linux (Debian 11)
Dificultad	Medium
Estado	Retired
IP objetivo	`10.129.56.190`

Mapa del ataque

[161/UDP] SNMP — rocommunity "public" sin vista asociada
   │  hrSWRunParameters filtra el cmdline de check_host.sh:
   │  svc : XjH7VCehowpR1xZB
   ▼
[API] Nagios XI /api/v1/authenticate — no comprueba el flag "enabled"
   │  SSH y login web rechazan a svc; la API le da un token válido
   ▼
[SQLi]  CVE-2023-40931 — banner_message-ajaxhelper.php, ciega por tiempo
   │  extrae la API key de nagiosadmin
   ▼
[ADMIN]  API crea usuario admin -> Manage Plugins + CCM (check_local_users)
   │  RCE: clave SSH propia instalada en /home/nagios/.ssh
   ▼
[SSH]  nagios  (user.txt)
   │  sudo NOPASSWD manage_services.sh start npcd -> systemd ExecStart
   │  /usr/local/nagios/bin/npcd es escribible por nagios
   ▼
[ROOT]  sustituir npcd por un script -> systemd lo lanza como root -> bash SUID

1. Reconocimiento

1.1 Puertos TCP

sudo nmap -p- --min-rate 5000 -T4 -Pn -oN nmap_allports.txt 10.129.56.190
sudo nmap -p22,80,389,443,5667 -sCV -Pn -oN nmap_services.txt 10.129.56.190

22/tcp   open  ssh      OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
80/tcp   open  http     Apache httpd 2.4.56
|_http-title: Did not follow redirect to https://nagios.monitored.htb/
389/tcp  open  ldap     OpenLDAP 2.2.X - 2.3.X
443/tcp  open  ssl/http Apache httpd 2.4.56 ((Debian))
|_http-title: Nagios XI
| ssl-cert: Subject: commonName=nagios.monitored.htb/organizationName=Monitored/
|                    stateOrProvinceName=Dorset/countryName=UK
5667/tcp open  tcpwrapped

El certificado TLS revela el vhost nagios.monitored.htb. El puerto 5667 es NSCA (Nagios Service Check Acceptor) y el 389 es LDAP: todo coherente con una instalación de Nagios XI.

echo "10.129.56.190 monitored.htb nagios.monitored.htb" | sudo tee -a /etc/hosts

1.2 El puerto que cambia la partida

Con un servidor de monitorización delante, hay que escanear UDP. SNMP es el protocolo de monitorización y vive en el 161/udp: un escaneo TCP nunca lo vería.

sudo nmap -sU --top-ports 50 --min-rate 2000 -Pn -oN nmap_udp.txt 10.129.56.190

PORT      STATE  SERVICE
123/udp   open   ntp
161/udp   open   snmp

Olvidar el escaneo UDP es el error más frecuente en máquinas de monitorización. Aquí, sin el 161, no hay entrada posible.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.