Monitors

Verified writeups for the Monitors machine of Hack The Box

Monitors

$ tldr WP Spritz + LFI → Cacti 1.2.12 + OfBiz deser → docker cap_sys_module

·	·
Operating system	Linux
Difficulty	Hard
Vector	Web
IP	10.10.10.238
Retirement date	2021-10-09
Skills	Information Leakage WordPress Plugin Exploitation (Spritz) Local File Inclusion (LFI) Cacti 1.2.12 Exploitation Apache OfBiz Deserialization Attack (RCE) Docker Breakout (cap_sys_module Capabilitie) [PRIVILEGE ESCALATION]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Local File Inclusion (LFI)	HackTricks	Open
Local File Inclusion (LFI)	PayloadsAllTheThings	Open
Information Leakage	HackTricks	Open
Insecure Deserialization	PortSwigger	Open
WordPress Exploitation	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Travel — Linux, Hard
• Backdoor — Linux, Easy
• Apocalyst — Linux, Medium
• Jewel — Linux, Medium
• Laboratory — Linux, Easy

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-07-13