https://chaelsoo.me/tags/container-escape/Recent content in Container-Escape on kanyo's blogHugo -- gohugo.ioen-gbMon, 02 Mar 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-monitorsfour/Mon, 02 Mar 2026 00:00:00 +0000https://chaelsoo.me/writeups/htb-monitorsfour/<p>MonitorsFour is a Hard box and earns it, but not through obscurity. Each step is logical and builds on the last. The Docker escape at the end is the most interesting part, built around a real CVE with a CVSS of 9.3 that was still pretty fresh when this box dropped.</p> <h2 id="recon">Recon</h2> <p>Web app at <code>monitorsfour.htb</code>. Nothing immediately obvious on the landing page, so I started fuzzing endpoints.</p> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://monitorsfour.htb/FUZZ </span></span></code></pre></div><p>One endpoint stood out: <code>/user</code>. It accepted a <code>token</code> parameter, which immediately looked interesting. The question was what it actually did with that token.</p>