MonitorsTwo

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine MonitorsTwo (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; privilege escalation via sudo. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.211 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.211 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.211 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-24 01:20 PDT
Nmap scan report for monitorstwo (10.10.11.211)
Host is up (0.039s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 48add5b83a9fbcbef7e8201ef6bfdeae (RSA)
|   256 b7896c0b20ed49b2c1867c2992741c1f (ECDSA)
|_  256 18cd9d08a621a8b8b6f79f8d405154fb (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Login to Cacti
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 17.73 seconds

1. Based from the nmap result, the machine runs a web application and opens ssh logins.

2. Luckily we can see the Cacti version. Researching on the internet shall leads to this CVE documentation --> https://vulners.com/exploitdb/EDB-ID:51166.

3. Reviewing the source code, seems the attack approach is we need to access /remote_agent.php and add another request header parameter --> X-Forwarded-For.

4. This should be our foothold to do reverse shell.

5. Let's set a listener on port 1337, setup python server at port 80 so we can curl our bash reverse shell file to the remote server using burpsuite.

6. Don't forget to do URL encoding for the curl command.

PAYLOAD TO SEND

REQUEST TO SEND

1. Running ls you shall see bunch files. Tbh took me a while until I found a directory which holds config.php file -> it has MySQL cred.

/var/www/html/include/config.php

1. Great! Using this information, we can connect to Cacti database on MySQL.
2. This should allows us to enumerate the tables.

CONNECTING TO CACTI DB

mysql -h db -u root -proot cacti -e 'show databases;'

Use cacti

mysql -h db -u root -proot cacti -e 'use cacti; show tables;'

1. Got bunch results again, but user_auth could be our interest.

Dumping user_auth

1. Great! Found the admin cred, let's make it more clear by selecting username and password only.

2. Noticed there's 2 creds that should be our interest --> admin and marcus.

3. Let's use john to crack both hashes.

4. Long story short, only marcus hash can be cracked by john.

LOGIN AS MARCUS

1. Sadly we can't check sudo permission for marcus.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.