https://wearethebug.dev/tags/docker-exec/Recent content on WE ARE THE BUGTradecraften-usSun, 23 Jan 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-data/Sun, 23 Jan 2022 00:00:00 +0000https://wearethebug.dev/posts/vl-data/Data is an Easy Linux machine that involves exploiting CVE-2021-43798, an arbitrary file read via path traversal in Grafana. By exploiting this vulnerability, the database file for Grafana is extracted, and the hashes in the database are converted to a format readable by Hashcat. The hash is then cracked and can be used for SSH access to the target as user boris. The compromised user has the privileges to execute docker exec as root on the system, allowing the user to escalate and obtain root access by adding the privileged flag to running containers and mounting the host filesystem.