> For the complete documentation index, see [llms.txt](https://aashraymt.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aashraymt.gitbook.io/docs/writeups/hackthebox-writeups/htb-monitorsfour.md).
# HTB — MonitorsFour
The system presents a multi-stage exploitation path that begins with web-based information disclosure and authentication bypass, transitions into authenticated remote code execution within a containerized environment, and concludes with a container escape to the host operating system.
| | |
| ----------------------------- | ----------------------------------- |
| **Machine Name** | MonitorsFour |
| **IP Address** | 10.10.11.98 |
| **Primary OS** | Windows (Host) / Linux (Container) |
| **Initial Foothold** | CVE-2025-24367 (Cacti RCE) |
| **Root Privilege Escalation** | Docker Remote API (Unauthenticated) |
### Recon
A SYN stealth scan was conducted to identify open TCP ports and the associated service versions.
The port 5985 shows that it is an Windows environment and this port is utilized by Windows Remote Management system. The specific banner `Microsoft HTTPAPI 2.0` signifies that the web requests are being processed by the Windows kernel-mode driver.
### Web server
Initial interaction with the web server on port 80 resulted in a 302 redirect to `http://monitorsfour.htb/`. For this add domain to the local `/etc/hosts` file.
A Nikto vulnerability scan was performed on the primary domain to identify potential misconfigurations or information leaks.
The scan results highlighted several critical data points:
* The server is utilizing PHP version 8.3.27.
* An `.env` file was detected at the root directory.
* Standard security headers such as `X-Frame-Options` and `X-Content-Type-Options` were missing.
* The `PHPSESSID` cookie was issued without the `HttpOnly` flag, increasing the risk of session hijacking via Cross-Site Scripting (XSS).
The exposure of `.env` file at `http://monitorsfour.htb/.env` provided immediate insight into the backend infrastructure. Although the file retrieved during the initial phase contained empty values for sensitive credentials, it explicitly defined the database environment as MariaDB and identified the database host as an internal entity named `mariadb`. This confirmed a multi-container or microservices architecture where the web server, application, and database are segmented.
### **Enumeration and Discovery**
Now we **fuzz subdomains** by injecting words into the **Host header** to discover virtual hosts like `cacti.monitorsfour.htb`.
We discover of `cacti.monitorsfour.htb` put it in etc hosts.
Cacti 1.2.28 is vulnerable to an *Unauthenticated Remote Code Execution (RCE)*.
#### The key vulnerability (simple explanation)
* Vulnerability: CVE-2024-25641
* Type: Unauthenticated RCE
* Impact: An attacker can execute system commands without logging in
### **Exploit: Authentication Bypass Via PHP Type Juggling**
This happens because **PHP’s loose comparison (`==`) automatically converts strings that look like scientific notation into numbers**.
* Strings like **`"0e1234"`** are interpreted as **`0 × 10^1234`**, which equals **`0`**
* So PHP treats **any `0e` string as numeric `0`**
That’s why:
* `"0e1234" == "0e9999"` → **TRUE** (both become `0`)
* `"0e1234" == 0` → **TRUE**
**This is called a magic hash vulnerability, and it can allow authentication bypass if hashes are compared with `==` instead of `===`.**
By providing `token=0e1234` to the `/user` endpoint, the token validation was bypassed, resulting in a full dump of the user database. This leak included usernames, email addresses, roles, and MD5-hashed passwords for multiple employees.
The MD5 hash for the user `admin` (Marcus Higgins), `56b32eb43e6f15395f6c46c1c9e1cd36`, was cracked to reveal the plaintext password.
### Exploit: CVE-2025-24367
The version of Cacti identified (1.2.28) is susceptible to a high-severity Remote Code Execution (RCE) vulnerability tracked as CVE-2025-24367. This flaw stems from improper input validation when Cacti interacts with the RRDTool binary to generate graph data.
{% embed url="" %}
The exploit successfully established a reverse shell connection to the attack machine on port 60001, providing a foothold as the `www-data` user.
The user flag was located in the home directory of the `marcus` user at `/home/marcus/user.txt`.
Checking the network topology to confirm we are in a docker so docker escape is the move.
The strategy is simple but devastating: use the API to create a new container and **mount the host's entire C: drive** into it.
I crafted a `create_container.json` payload to automate the flag retrieval:
* **Image:** Uses the local `docker_setup-nginx-php:latest`.
* **Binds:** Maps the host’s `/mnt/host` (the Windows filesystem) to `/host_root` inside my new container.
* **Cmd:** A simple `cat` command to grab the root flag from the Administrator's desktop.
Using the foothold shell, I executed the attack in three quick steps:
**1. Create the Container** I sent the JSON to the API. It returned a Container ID (`cid`) of `ba5a8b414db5...`.
```
curl -H 'Content-Type: application/json' -d @create_container.json http://192.168.65.7:2375/containers/create -o response.json
```
**2. Start the Engine** I triggered the container to run. Behind the scenes, it mounted the host's drive and executed my `cat` command.
```
curl -X POST http://192.168.65.7:2375/containers/ba5a8b414db5/start
```
**3. Collect the Loot** Since the container runs and exits immediately, I queried the logs to see the output of my command.
```
curl "http://192.168.65.7:2375/containers/ba5a8b414db5/logs?stdout=1"
```
I had been doing a lot of interviews lately, so I decided to pick on some Remediation and Recommendations for this machine, which I would suggest if I were asked about it.
The compromise of the MonitorsFour environment was made possible by a chain of configuration errors and application-level flaws. Securing such an environment requires a defense-in-depth approach.
#### 1. Web Application Hardening
The initial credential leak was enabled by PHP Type Juggling. All comparison logic in PHP must utilize the strict equality operator (`===`), which validates both value and type, preventing the evaluation of "Magic Hashes".
```
// VULNERABLE
if ($_GET['token'] == $server_token) {... }
// SECURE
if ($_GET['token'] === $server_token) {... }
```
Furthermore, sensitive files such as `.env` and `.git` directories must be explicitly blocked at the web server level. In an nginx environment, the following configuration should be applied:
```
location ~ /\.(env|git) {
deny all;
}
```
#### 2. Cacti Framework Security
Organizations using Cacti must upgrade to version 1.2.29 or higher to remediate CVE-2025-24367. Additionally, the Cacti application should be configured to run as a dedicated, low-privilege system user. The `register_argc_argv` setting in `php.ini` should be set to `Off` unless specifically required, as it can contribute to other RCE vectors within the platform.
#### 3. Securing the Docker Infrastructure
The exposure of the Docker Remote API is the most critical vulnerability identified. Several steps should be taken to harden the Docker daemon:
* **Disable Remote TCP Access**: Whenever possible, use the default Unix socket (`/var/run/docker.sock`) for local communication. Remote management should be conducted over an encrypted SSH tunnel rather than an exposed port.
* **Enable TLS Authentication**: If the API must be exposed over the network, it must be secured using Mutual TLS (mTLS) on port 2376. This requires both the server and the client to possess valid certificates issued by a trusted Internal Certificate Authority (CA).