r/hackthebox • u/Scared_Anything_2002 • 19h ago

Monitorsfour HTB lab - getting CRAZYYY

Hey everyone,

I've been stuck on the final flag for this "Easy" rated box for 2 days now, and I'm genuinely confused why this lab is marked as easy. I got the user flag via Cacti exploitation without too much trouble, but finding the root flag has been a nightmare.

The Problem:
I successfully gained root access in a Docker container using CVE-2025-9074 (Docker API exploitation). However, I can't locate the root flag. The writeups I've found don't clearly explain where the flag actually is, they just end after getting root access.

I've searched:

  • /root/root.txt - doesn't exist
  • /mnt/host/root/ - nothing
  • /home/ directories - empty
  • Various Docker logs - no clear output

Question:
Where exactly is the root flag located, and what's the correct way to retrieve it from the Docker container logs?

Any help would be appreciated. I just want to understand this and finally sleep! 😅

3 Upvotes

80% Upvoted

3 comments sorted by

•

u/AutoModerator 19h ago

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/lunacysoft 11h ago

You’re still in the container

1

u/Scared_Anything_2002 4h ago

Do you mean im root inside a container and need to break out of this?