[RebeLHeX]

I tried this with no luck.. what is your endpoint ?

PING WORKS!

---

ok got the ping also working with service icmp so we are allowed to use some cmd.cgi

curl snippet
--data-binary $'nagFormId=a30151f1&cmd_typ=3&cmd_mod=2&host=10.10.x.x&service=icmp&persistent=on&com_data=test&btnSubmit=Commit' \
$'https://nagios.monitored.htb/nagios/cgi-bin/cmd.cgi'

[fenrir54]

Nagios core is running on https://nagios.monitored.htb/nagios/
And I'm able to log in with svc:XjH7VCehowpR1xZB but can't find anything useful

[punt0]

I tried this with no luck.. what is your endpoint ?

PING WORKS!

---

ok got the ping also working with service icmp so we are allowed to use some cmd.cgi

curl snippet
--data-binary $'nagFormId=a30151f1&cmd_typ=3&cmd_mod=2&host=10.10.x.x&service=icmp&persistent=on&com_data=test&btnSubmit=Commit' \
    $'https://nagios.monitored.htb/nagios/cgi-bin/cmd.cgi'

But how are you supposed to upload cmd.cgi to the server?

[Art10n]

Trying to get son useful in CGIs but nothing

GET /nagios/cgi-bin/cmd.cgi?cmd_typ=22&host=localhost&service=SSH HTTP/1.1

POST /nagios/cgi-bin/cmd.cgi HTTP/1.1
...

nagFormId=a9e827f8&cmd_typ=22&cmd_mod=2&host=localhost&service=SSH&btnSubmit=Commit

[zeroedbykrycek]

you all got into https://nagios.monitored.htb/nagiosxi/login.php with svc:XjH7VCehowpR1xZB  ????

I get The specified user account has been disabled or does not exist.

[peasantgandalf]

you all got into https://nagios.monitored.htb/nagiosxi/login.php with svc:XjH7VCehowpR1xZB  ????

I get The specified user account has been disabled or does not exist.

not  https://nagios.monitored.htb/nagiosxi/login.php try https://nagios.monitored.htb/nagios/

[Art10n]

Try to find SQLi in
POST /nagiosxi/admin/banner_message-ajaxhelper.php HTTP/1.1
Host: nagios.monitored.htb
...
action=acknowledge_banner_message&id=3

No much success (maybe a rabbit hole)

[zeroedbykrycek]

i'll share full writeup 100% free tomorrow, i have rooted

any hint on what to look into after getting the nagios panel using svc creds?

[peRd1]

any hint on what to look into after getting the nagios panel using svc creds?

Try finding an sql injection vulnerability and dumb those tables

[punt0]

any hint on what to look into after getting the nagios panel using svc creds?

Try finding an sql injection vulnerability and dumb those tables

But where should we find the SQLi, in the Nagios XI login?