Join The Best Hacking Community Worldwide | Hack The Box
Over half a million platform members exhange ideas and methodologies. Be one of us and help the community grow even further!
www.hackthebox.com
Enumeration
Nmap shows three active services: SSH on port 22, a web server on port 80, and an unknown service on port 8065.
ports=$(nmap -p- --min-rate=1000 -T4 10.129.235.124 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)
nmap -p$ports -sC -sV 10.129.235.124 -v -oN nmap_tcpVisiting http://10.129.235.124 reveals a Delivery landing page.
The frontend appears to be a static HTML page, but the HelpDesk link redirects to http://helpdesk.delivery.htb/. We need to add this hostname to the /etc/hosts file on our local machine.
10.129.235.124 delivery.htb helpdesk.delivery.htbThe “Contact Us” link directs unregistered users to the HelpDesk. By providing a valid company email, it becomes possible to access the MatterMost server at delivery.htb:8064. It appears that open registration on MatterMost is also enabled.
Browsing to the HelpDesk subdomain reveals that it is running the osTicket support ticketing system.
Foothold
HelpDesks typically let users send emails to a temporary address in order to update the status of an open ticket. However, if the corporate domain is used for tickets, this feature could give non-employees access to @company.com email addresses. Since many cloud services accept email domains as proof of employment, this might provide access to internal services. Let’s go ahead and create a new ticket.
Clicking the Create Ticket button redirects to a success page.
When a support ticket is created, a company email address in the @delivery.htb domain is issued. We can then use this email to register a new user account.
Next, we check the status of our support ticket to see if anything has been updated.
We have received an invitation. By visiting the confirmation URL, we can access the MatterMost instance and successfully join the Internal team.
The Internal team appears to be discussing updates to the osTicket system’s theme. Within the conversation, some credentials are shared: maildeliverer:Youve_G0t_Mail!. They also mention developing a program to help prevent re-using the same passwords, with “PleaseSubscribe!” provided as a hint. Using the given credentials, we can log in via SSH as the maildeliverer user.
Privilege Escalation
During filesystem enumeration, the MatterMost configuration file was located at /opt/mattermost/config/config.json. Reviewing this file reveals the SqlSettings section, which contains the database credentials.
cat /opt/mattermost/config/config.jsonOn checking the internal ports, we can see that the SQL port is open.
maildeliverer@Delivery:~$ ss -ntlp
<SNIP>
LISTEN 0 80 127.0.0.1:3306 0.0.0.0:* Using the discovered credentials, we can now log in to the mattermost MySQL database.
Further enumeration of the database allows us to extract the root hash from the Users table.
MariaDB [mattermost]> show tables;
+------------------------+
| Tables_in_mattermost |
+------------------------+
| Audits |
<SNIP>
| Users |
+------------------------+
46 rows in set (0.000 sec)
MariaDB [mattermost]> select * from Users;
<SNIP>
root | $2a$10$VM6E<SNIP>gjjO | NULL | | root@delivery.htb
<SNIP> From our earlier access to the Internal team, we recall the MatterMost root user warning about not reusing passwords, specifically mentioning the word “PleaseSubscribe!”. We can generate a wordlist based on “PleaseSubscribe!” with Hashcat and then use John the Ripper to crack the root hash.
┌──(kali㉿kali)-[~/Delivery]
└─$ echo PleaseSubscribe! | hashcat -r /usr/share/hashcat/rules/best64.rule --stdout
PleaseSubscribe!
!ebircsbuSesaelP
PLEASESUBSCRIBE!
pleaseSubscribe!
PleaseSubscribe!0
<SNIP>This generates a small wordlist, which we save to a file named wordlist. We then use John to crack the root hash with this wordlist.
The hash is successfully cracked, allowing us to use the root credentials to log in as the root user on the target machine.
maildeliverer@Delivery:~$ su root
Password:
root@Delivery:/home/maildeliverer# cd /root
root@Delivery:~# ls
mail.sh note.txt py-smtp.py root.txt
root@Delivery:~# cat root.txt
47d9<SNIP>2393References
- https://medium.com/intigriti/how-i-hacked-hundreds-of-companies-through-their-helpdesk-b7680ddc2d4c
- HTB Official Walkthrough for Delivery