HackTheBox - Planning
Source: YouTube · IppSec · published Sep 13, 2025 · 36:06
The video demonstrates a Hack the Box penetration test where an outdated Grafana instance is exploited for initial access, leading to privilege escalation via container escape and credential discovery.
Key Takeaways:
• Initial discovery reveals an outdated Grafana version on a subdomain with a known RCE exploit 1:12.
• Post-exploitation confirms the target is running within a container environment 1:17.
• Environment variables expose a password allowing SSH access to the host machine 1:22.
• A local Chronabs UI service is identified, protected by authentication but accessible via port forwarding 1:37.
• Analysis of the Chronabs database file reveals critical internal credentials 1:40.
This walkthrough highlights the importance of virtual host scanning and the risks associated with outdated software and exposed environment variables.
Sources:
- 0:08 Discovery of subdomain hosting outdated Grafana.
- 0:14 Exploitation of Grafana RCE vulnerability.
- 0:19 Identification of container environment.
- 0:22 Extraction of SSH password from environment variables.
- 0:35 Accessing local Chronabs UI via port forwarding.
- 0:40 Analyzing Chronabs database for credentials.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is IPS doing planning from Hack the Box, which starts out discovering the homepage of this box isn't vulnerable to anything meaningful. But doing a virtual host scan, we can discover a subdomain that's hosting a outof-date version of Graphana that has a public exploit that leads to remote code execution. We can get into this box and discover that we're in a container. Looking at the environment variables, we discover a password that lets us SSH into the box. From here, we discover a kronabs.db file is within opt, which is a bit odd. Looking into it, it looks like it's part of the Chronab UI package which is listening on local host. Forwarding the port back to us and trying to access it, we discover it's protected with a username and password. Looking into the…