> For the complete documentation index, see [llms.txt](https://aditya-3.gitbook.io/oscp/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aditya-3.gitbook.io/oscp/readme/walkthroughs/vuln-lab/data-vulnlab.md).

# Data

There is website running grafana at port 3000 ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-461709488afe1bbb158a840d0d1f644e0a1c2847%2Fb6a86af948f5d4fa1fdca2f72f0f4939.png?alt=media)

Using an exploit available we can get the grafana.db file. ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-d87bf4d52da8605a923f47946af45676f709b5ec%2Ffac1626811132d13d1fd945500397b87.png?alt=media) We get the users

Now running decrypt.py:

```
import hashlib
import base64
password= '7a919e4bbe95cf5104edf354ee2e6234efac1ca1f81426844a24c4df6131322cf3723c92164b6172e9e73faf7a4c2072f8f8'
salt = 'YObSoLj55S'
decoded_hash = bytes.fromhex(password)
hash64 = base64.b64encode(decoded_hash).decode('utf-8')
salt64 = base64.b64encode(salt.encode('utf-8')).decode('utf-8')
print("sha255:10000:"+salt64+":"+hash64+"\n")    
```

Now we get a hash we can crack in hashcat.

Cracking the hash we get cred: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-2cb306bf8e096e453033fb67bf4c21a50b98f5bf%2Fa138f3173a77861f37626ae99b6f31c2.png?alt=media) Now using ssh and logging in we have sudo privilege on docker exec: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-c6651c7834ab16b122c2cc8e5ef3776d92c5c60c%2F06a0e76a659090464cf3a706e9270a1e.png?alt=media) The /etc/passwd obtained from LFI is different than the one on this box so it might be a docker container.

When creating a Docker container if -h or -hostname is not specified then hostname is container name.

So getting hostname from grafana machine using LFI: ![](https://2519178678-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FuE2sPgM0QY6KfiTIG8Vs%2Fuploads%2Fgit-blob-0388c4f0c4ff4645629a7bdda7effbbefeba6aa7%2F41fbcc4fa56c646f77c5ca6951616b32.png?alt=media) To get into container:

```
sudo docker exec --privileged --user 0 -it e6ff5b1cbc85 /bin/sh
```