[paven]

Monitored - Linux - Medium

Good luck everyone! Let's tackle this together!
https://app.hackthebox.com/machines/Monitored

[RebeLHeX]

Good luck and Happy Fucking Hacking!!!

[DataNinja]

ldap anonymous login

| ldap-search: |  Context: dc=monitored,dc=htb |    dn: dc=monitored,dc=htb |        objectClass: top |        objectClass: dcObject |        objectClass: organization |        o: monitored.htb |_        dc: monitored | ldap-rootdse: | LDAP Results |  <ROOT> |      namingContexts: dc=monitored,dc=htb |      supportedControl: 2.16.840.1.113730.3.4.18 |      supportedControl: 2.16.840.1.113730.3.4.2 |      supportedControl: 1.3.6.1.4.1.4203.1.10.1 |      supportedControl: 1.3.6.1.1.22 |      supportedControl: 1.2.840.113556.1.4.319 |      supportedControl: 1.2.826.0.1.3344810.2.3 |      supportedControl: 1.3.6.1.1.13.2 |      supportedControl: 1.3.6.1.1.13.1 |      supportedControl: 1.3.6.1.1.12 |      supportedExtension: 1.3.6.1.4.1.4203.1.11.1 |      supportedExtension: 1.3.6.1.4.1.4203.1.11.3 |      supportedExtension: 1.3.6.1.1.8 |      supportedLDAPVersion: 3 |      supportedSASLMechanisms: DIGEST-MD5 |      supportedSASLMechanisms: NTLM |      supportedSASLMechanisms: CRAM-MD5 |_      subschemaSubentry: cn=Subschema

[Impulsive1393]

SNMPWALK shows info

[Incuerd0]

https://nagios.monitored.htb/nagiosxi/login.php

[herpyderp]

From SNMP output

iso.3.6.1.2.1.25.4.2.1.5.578 = STRING: "-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "

[sneakymcsneaky]

Allows a login to:

https://nagios.monitored.htb/nagios/

[punt0]

From SNMP output

iso.3.6.1.2.1.25.4.2.1.5.578 = STRING: "-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "

How did you get that SNMP info? I've almost never seen that protocol

Also those could be credentials for https://nagios.monitored.htb/nagiosxi/terminal

[DataNinja]

From SNMP output

iso.3.6.1.2.1.25.4.2.1.5.578 = STRING: "-c sleep 30; sudo -u svc /bin/bash -c /opt/scripts/check_host.sh svc XjH7VCehowpR1xZB "

How did you get that SNMP info? I've almost never seen that protocol

Also those could be credentials for https://nagios.monitored.htb/nagiosxi/terminal

https://book.hacktricks.xyz/network-serv...sting-snmp

[Art10n]

Nothing interesting at the moment:
---- Scanning URL: https://nagios.monitored.htb/nagiosxi/ ----
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/about/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/account/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/admin/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/api/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/backend/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/config/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/db/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/help/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/images/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/includes/
+ https://nagios.monitored.htb/nagiosxi/index.php (CODE:302|SIZE:27)
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/mobile/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/reports/
+ https://nagios.monitored.htb/nagiosxi/sounds (CODE:403|SIZE:286)
+ https://nagios.monitored.htb/nagiosxi/terminal (CODE:200|SIZE:5215)
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/tools/
==> DIRECTORY: https://nagios.monitored.htb/nagiosxi/views/