Extra Notes

Planning

Summary

“Planning” is an easy-level Linux box from HTB’s Season 7. It challenges users to perform web and subdomain enumeration, leverage a Grafana RCE (CVE‑2024‑9264), escape from a Docker container, and execute a cron-based escalation to obtain root privileges.

As is common in real life pentests, you will start the Planning box with credentials for the following account: admin / 0D5oT70Fq13EvB5r

Executive Summary

The Planning machine presented a realistic, multi-layered attack scenario that showcased the risks of misconfigured services and insecure DevOps practices in containerized environments.

We began with external enumeration, identifying a vulnerable Grafana instance exposed on the subdomain grafana.planning.htb. Using known credentials provided in the challenge and chaining it with CVE-2024-9264 (Grafana SQL Expressions RCE), we achieved initial access by executing a reverse shell inside a running container.

Inside the container, we enumerated the environment variables and discovered reused Grafana admin credentials, which allowed lateral movement to the host system via SSH. As user enzo, we performed further enumeration and uncovered a custom crontab scheduling service, implemented via an unprotected JSON database.

Additionally, by inspecting network bindings, we discovered several internal services listening on 127.0.0.1, including a custom service on port 8000. However, the most impactful discovery was that the crontab system allowed arbitrary command injection, and those commands were executed by root without validation.

We exploited this by injecting a payload that copied /bin/bash to /tmp/pwner and set the SUID bit, then executed it with the -p flag—granting us a fully privileged root shell on the host.

Challenge Information

  • Name: Planning

  • Platform: Hack The Box (HTB)

  • Category: Linux (Windows)

  • Difficulty: Easy

  • Objective: Exploit Linux to retrieve the flag.

  • Key Exploit: Grafana

Field
Description

Name

Planning

Difficulty

Easy

Operating System

Linux

Points

20

Release Date

May 10, 2025

Created by

d00msl4y3r & FisMatHack

Enumeration

The first phase in attacking any target is thorough enumeration. In this case, we initiated a comprehensive TCP port scan using Nmap to identify open services and potential attack surfaces.

nmap -sC -sV -p- 10.10.11.68

This revealed only two open ports: 22 (SSH) and 80 (HTTP).

This indicates that name-based virtual hosting is in use. To properly interact with the web service, we mapped this domain to our local machine by editing /etc/hosts:

echo "10.10.11.68 planning.htb" | sudo tee -a /etc/hosts

Subdomain Enumeration with ffuf

Since virtual hosting was in play, it was logical to perform subdomain brute-forcing to uncover hidden services. We used ffuf a common subdomain wordlist.

Another subdomain was discovered: grafana.planning.htb, which strongly implied the presence of a Grafana instance—a known attack surface in recent CVEs.

We updated /etc/hosts again to resolve this subdomain:

Navigating to http://grafana.planning.htb confirmed the existence of a Grafana login panel.

Initial Foothold

With the subdomain grafana.planning.htb discovered during enumeration, the next logical step was to investigate the Grafana web application hosted there. Grafana is a widely used observability platform, and older or misconfigured instances have been subject to critical vulnerabilities.

The challenge description provided the following credentials:

We navigated to http://grafana.planning.htb/login and attempted to authenticate:

Upon successful login, we gained access to the Grafana 11.0.0 dashboard. This version is known to be vulnerable to a Remote Code Execution (RCE) flaw—CVE-2024-9264—when the server is configured with certain plugins or integrations.

CVE-2024-6494

In Grafana 11.0.0, a new feature called SQL Expressions allows users to write expressions and transform the output of SQL queries. If improperly sandboxed or if a vulnerable plugin (like PostgreSQL, MySQL, or SQLite) is used without security restrictions, an attacker can abuse sql.Expression fields to execute arbitrary shell commands.

This specific vulnerability was identified under CVE-2024-9264 and can lead to full code execution under the context of the Grafana process.

Once the reverse shell was successfully established using the Grafana SQL Expressions RCE (CVE-2024-9264), our shell dropped us into what appeared to be a Docker container:

This confirmed that Grafana was running in an isolated containerized environment. To understand the container’s configuration, we began by dumping the environment variables, which often reveal service credentials, file paths, and runtime configurations.

Key Findings

Variable
Description

GF_SECURITY_ADMIN_USER & GF_SECURITY_ADMIN_PASSWORD

Confirmed login credentials for the Grafana web UI

GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS

Confirms that the shellfs plugin is enabled, allowing the exploitation used for RCE

GF_PATHS_CONFIG

Path to Grafana's main configuration file (grafana.ini)

GF_PATHS_DATA

Data storage directory within the container

The leaked credentials enzo : RioTecRANDEntANT! appeared to be a reused system account and became immediately valuable for lateral movement outside the container.

Lateral Move: SSH Access as Enzo

Based on the credentials found in the environment, we attempted to authenticate to the host via SSH, and this successfully granted us access to the host system as enzo, confirming that the Docker container was misconfigured to reuse privileged credentials.

Privilege Escalation: Crontab Analysis

Upon gaining access to the host, we inspected scheduled tasks for misconfigurations or abuse opportunities. In /opt/crontabs, we discovered a JSON-based crontab scheduler database:

To further assess potential privilege escalation vectors, we enumerated all services listening on the host system:

Of particular interest is 127.0.0.1:8000, which is only accessible from localhost and likely intended as an internal service or admin panel.

Accessing Internal Service via SSH Port Forwarding

To investigate the service running on port 8000, we used SSH port forwarding from our attacker machine:

ssh -L 8000:127.0.0.1:8000 enzo@planning.htb

This command binds the remote host’s 127.0.0.1:8000 to our local localhost:8000, allowing us to interact with the service via a browser or tools like curl.

After forwarding, we visited:

To gain root access, we used the cron execution engine to create a SUID binary backdoor. Specifically:

  • Copy /bin/bash to a world-accessible location

  • Set the SUID permission bit

  • Execute the resulting binary with -p to escalate

  • Run now.

Once the binary was created and marked with the SUID bit, we ran:

/tmp/pwner -p

We now had full root access on the host.

Last updated