MonitorsFour — HTB Writeup | The Hack Sparrow

Executive summary — MonitorsFour is a Windows machine whose backend runs on Docker Desktop + WSL2, and it doesn't fall to a single exploit but by chaining flaws: an unauthenticated IDOR dumps every user and their MD5 hash, the admin hash is cracked with hashcat, those credentials are reused on an internal Cacti panel vulnerable to authenticated RCE (CVE-2025-24367), and from the compromised container we pivot with chisel to an unauthenticated Docker API that lets us mount the host root and gain root. A Web → Cacti → Container → Docker API → Host Root path.

Platform	Hack The Box
Operating system	Windows
Difficulty	Easy
Status	Retired
Target IP	`10.129.33.16`

Attack map

[80/HTTP + 5985/WinRM]  nginx → vhost monitorsfour.htb
   │  IDOR (token=0) on /user → dump of users + MD5 hashes
   ▼
[MD5 hashes]  unsalted → hashcat + rockyou → admin/Marcus : wonderful1
   │  hidden vhost  cacti.monitorsfour.htb  (Cacti 1.2.28)
   ▼
[Cacti]  credential reuse  marcus:wonderful1
   │  CVE-2025-24367 (Graph Template RCE) → .php in the webroot
   ▼
[Docker container]  www-data shell → user.txt
   │  chisel  R:2375:192.168.65.7:2375  (internal Docker API)
   ▼
[Docker API 2375]  unauthenticated → container with host  /  mounted
   ▼
[ROOT Windows host / WSL2]  chroot /host → root.txt

1. Reconnaissance

We start by mapping the full attack surface with a complete nmap scan (all ports, default scripts and version detection):

nmap -sC -sV -p- --min-rate 3000 -oN nmap_10.129.33.16.txt 10.129.33.16

Result:

PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx
|_http-title: Did not follow redirect to http://monitorsfour.htb/
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Analysis: just two ports. 80/tcp (nginx) forces a redirect via the Host: header to monitorsfour.htb, and 5985/tcp (WinRM) confirms a Windows host. WinRM wasn't used in the chain —no valid native credentials turned up—; the real vector is HTTP only.

Resumen ejecutivo — MonitorsFour es una máquina Windows cuyo backend corre sobre Docker Desktop + WSL2, y no cae por un exploit único sino encadenando fallos: un IDOR sin autenticación vuelca los usuarios y sus hashes MD5, el hash del administrador se crackea con hashcat, esas credenciales se reutilizan en un panel Cacti interno vulnerable a RCE autenticado (CVE-2025-24367), y desde el contenedor comprometido se pivota con chisel hasta una Docker API expuesta sin autenticación que permite montar la raíz del host y obtener root. Un recorrido Web → Cacti → Contenedor → Docker API → Host Root.

Plataforma	Hack The Box
Sistema operativo	Windows
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.33.16`

Mapa del ataque

[80/HTTP + 5985/WinRM]  nginx → vhost monitorsfour.htb
   │  IDOR (token=0) en /user → volcado de usuarios + hashes MD5
   ▼
[Hashes MD5]  sin sal → hashcat + rockyou → admin/Marcus : wonderful1
   │  vhost oculto  cacti.monitorsfour.htb  (Cacti 1.2.28)
   ▼
[Cacti]  reutilización de credenciales  marcus:wonderful1
   │  CVE-2025-24367 (Graph Template RCE) → .php en el webroot
   ▼
[Contenedor Docker]  shell www-data → user.txt
   │  chisel  R:2375:192.168.65.7:2375  (Docker API interna)
   ▼
[Docker API 2375]  sin autenticación → contenedor con  / del host montado
   ▼
[ROOT host Windows/WSL2]  chroot /host → root.txt

1. Reconocimiento

Empezamos mapeando toda la superficie de ataque con un escaneo completo de nmap (todos los puertos, scripts por defecto y detección de versiones):

nmap -sC -sV -p- --min-rate 3000 -oN nmap_10.129.33.16.txt 10.129.33.16

Resultado:

PORT     STATE SERVICE VERSION
80/tcp   open  http    nginx
|_http-title: Did not follow redirect to http://monitorsfour.htb/
5985/tcp open  http    Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Análisis: solo dos puertos. El 80/tcp (nginx) fuerza un redirect por cabecera Host: hacia monitorsfour.htb, y el 5985/tcp (WinRM) confirma que el host es Windows. WinRM no se usó en la cadena —no aparecieron credenciales nativas válidas—; el vector real es exclusivamente HTTP.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.