Monitoring (TJNull List )

It’s my writeup on monitoring machine available at pg play platform on offsec.

RECON

FIRST THING FIRST (RUSTSCAN):

Services version enum(NMAP):

Found 2 logins based on NagiosXI platform

http://192.168.190.136/nagiosxi/login.php?redirect=/nagiosxi/index.php%3f&noauth=1

this one’s strange (NSP: Sorry Dave, I can’t let you do that)

https://192.168.190.136/nagiosxi/login.php?redirect=/nagiosxi/index.php%3f&noauth=1

For the another one (with https) we found default login creds: nagiosadmin:admin

Tried to look for an rce exploit of this service and found one:

and it worked and we got direct root access: