HackTheBox - MonitorsFour

Why It Matters

Manual, primitive‑focused exploitation reveals hidden flaws and teaches techniques that automated tools often miss, improving penetration‑testing effectiveness.

Key Takeaways

• Fuzzing token endpoint reveals critical PHP type‑juggling vulnerability.
• Exploited Cacti CVE for remote command execution on Windows host.
• Leveraged Docker Desktop CVE to achieve privilege escalation.
• Manual exploitation teaches reusable primitives over automated scripts.
• Misconfigured filter settings can hide critical discovery during fuzzing.

Summary

The video walks through the Hack The Box "Monitors4" machine, showing a hands‑on, manual exploitation path rather than relying on pre‑written scripts. The presenter starts with basic reconnaissance, discovers a single HTTP service running Nginx on Windows, and then fuzzes a token endpoint to expose a PHP type‑juggling flaw that yields a 32‑character MD5 hash. Using that token, he cracks the hash on hashes.com, logs in as admin, and pivots to deeper enumeration. Key steps include exploiting two CVEs: a remote command execution flaw in Cacti and a privilege‑escalation vulnerability in Docker Desktop 4.44.2. The analyst demonstrates how to use tools like fuff, GoBuster, and curl, while emphasizing the importance of correct filter settings—highlighting a mistake where filtering on HTTP 302 hid the Cacti endpoint. He also explains Windows’ “worst‑fit” character translation, which can bypass filters in PHP CGI contexts. Notable moments feature the discovery of the Windows translation bug, the manual reconstruction of the admin credentials (admin / wonderfulone), and the use of MD5 hash cracking to gain initial access. The presenter notes that the Cacti version appears in the HTTP banner and that mis‑filtering size versus status code can delay discovery, illustrating common pitfalls in automated fuzzing. Overall, the walkthrough underscores that manual exploitation reinforces understanding of underlying primitives, making future attacks more efficient. It also serves as a reminder that even easy boxes contain nuanced configuration errors—like improper filter usage and legacy Windows quirks—that can be leveraged for full system compromise.

Original Description

00:00 - Introduction

00:57 - Start of nmap

03:20 - Looking at the webpage doing basic enumeration

05:30 - Talking about Orange Tsai Worst Fit -- Doesn't get us anything but a path i went down first

09:50 - Discovering the /user endpoint, fuzzing the token parameter discovering type juggling, cracking hashes

14:40 - Logging into the application, which seems like an odd static page

18:00 - Discovering the Cacti Domain, Logging in and showing we can enumerate if a user is valid or not by a timing attack

23:50 - Exploting CVE-2025-24367 , which lets us create php files on the target

28:40 - Creating the payload to drop the file to get RCE

36:00 - Shell returned.

38:10 - Using bash to be a basic port scanner, then dumping the database

45:00 - Manually exploiting CVE-2025-9074, talking to Docker over HTTP to create a container that mounts the host operating system in a container then reading the flag

55:00 - Getting code execution on the host by looking at scheduled tasks and changing a powershell script that runs every 3 minutes