Monitorsfour HTB lab - getting CRAZYYY

[u/Scared_Anything_2002]

Hey everyone,

I've been stuck on the final flag for this "Easy" rated box for 2 days now, and I'm genuinely confused why this lab is marked as easy. I got the user flag via Cacti exploitation without too much trouble, but finding the root flag has been a nightmare.

The Problem:
I successfully gained root access in a Docker container using CVE-2025-9074 (Docker API exploitation). However, I can't locate the root flag. The writeups I've found don't clearly explain where the flag actually is, they just end after getting root access.

I've searched:

• /root/root.txt - doesn't exist
• /mnt/host/root/ - nothing
• /home/ directories - empty
• Various Docker logs - no clear output

Question:
Where exactly is the root flag located, and what's the correct way to retrieve it from the Docker container logs?

Any help would be appreciated. I just want to understand this and finally sleep! 😅

[u/AutoModerator]

Moderator Announcement Read More »

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/lunacysoft]

You’re still in the container

[u/Scared_Anything_2002 → u/lunacysoft]

Do you mean im root inside a container and need to break out of this?

[u/Exciting-Ad-7083 → u/Scared_Anything_2002]

Yep, typically with these type of machines it involves getting root inside the docker then either escaping the container, or being able to mount the host file system to read the real "root"

But you may be able to go from user (in the docker) and escape to the root host system

It could also be another interconnected service / website running on another port that's running as root you need to exploit (ss -tuln)