Delivery

Enumeration

As always, we start with the enumeration phase, in which we try to scan the machine looking for open ports and finding out services and versions of those opened ports.

The following nmap command will scan the target machine looking for open ports in a fast way and saving the output into a file:

nmap -sS --min-rate 5000 -p- -T5 -Pn -n 10.10.10.222 -oN allPorts

  • -sS use the TCP SYN scan option. This scan option is relatively unobtrusive and stealthy, since it never completes TCP connections.

  • --min-rate 5000 nmap will try to keep the sending rate at or above 5000 packets per second.

  • -p- scanning the entire port range, from 1 to 65535.

  • -T5 insane mode, it is the fastest mode of the nmap time template.

  • -Pn assume the host is online.

  • -n scan without reverse DNS resolution.

  • -oN save the scan result into a file, in this case the allports file.

Now that we know which ports are open, let's try to obtain the services and versions running on these ports. The following command will scan these ports more in depth and save the result into a file:

nmap -sC -sV -p22,80,8065 10.10.10.222 -oN targeted

  • -sC performs the scan using the default set of scripts.

  • -sV enables version detection.

  • -oN save the scan result into file, in this case the targeted file.

Let's take a look at the website on port 80.

If we press on the CONTACT US button, a message pop up will appear saying that we need an @delivery.htb email address to have access to the MatterMost server.

If we click on the MatterMost server button, we'll be redirected to the delivery.htb domain on port 8065, and if click on the HelpDesk button, we'll be redirected to the helpdesk.delivery.htb domain. Let's add these domains to the /etc/hosts file, so we can access those websites.

nano /etc/hosts

Now, we can access the helpdesk.delivery.htb site.

And to the MatterMost web server.

Exploitation

Let's try to create a new account by clicking on the Create one now button.

But we get a message saying that we must verify our email. But we can't because that email doesn't exist, and if we enter an existent email, we won't get any verification email because the HTB machines doesn't have internet connection. So, we can't create an account for now. If we take a look at the other website, we'll see that it is a Support Ticket System site. Let's open a new ticket with some random information.

And the support ticket request is created.

We could check the ticket status by indicating the email and the ticket ID.

Now, we can see the ticket information.

Notice that when we created the ticket, we got a message saying the following.

If you want to add more information to your ticket, just email 6483323@delivery.htb.

This means that if the 6483323@delivery.htb email address receive any information, that information will be shown on the ticket thread. We create a new user in the MatterMost web server by taking advantage of this system. The idea is to create a user on the MatterMost web server with the 6483323@delivery.htb email address, so the confirmation email will appear on the ticket thread, and we'll be able to verify the account. Let's do it.

Now, we should get the verification email in the ticket thread.

Now, all we have to do is access the following URL to get the account verified.

http://delivery.htb:8065/do_verify_email?token=fikk1crukuu16jkt9ia1b85okerminztcj378e3g3bonxd8ztqgrbmsjc58n8xch&email=6483323%40delivery.htb

Once logged in, let's join the Internal team.

And then, skip the tutorial.

If we read the chat messages, we'll see that the root user is giving the maildeliverer:Youve_G0t_Mail! credentials. And he is saying that they are using passwords that are a variant of PleaseSubscribe!.

If we try to log in via SSH with those credentials, we'll be able to get a shell as the maildeliverer user and we'll be able to grab the user flag.

sshpass -p 'Youve_G0t_Mail!' ssh maildeliverer@10.10.10.222

Privilege Escalation

At this point, I started enumerating the machine, and I found the /opt/mattermost/config/config.json config file with some MySQL credentials.

cat /opt/mattermost/config/config.json

Let's access MySQL with those credentials.

mysql -u mmuser -pCrack_The_MM_Admin_PW

  • -u user for login.

  • -p password for login.

Now, let's list the databases.

show databases;

Then, access the mattermost database, and list all the tables.

use mattermost;

show tables;

Now, let's see the columns of the Users table.

describe Users;

And finally, select everything from the Username and Password columns from the Users table.

select Username,Password from Users;

We get a bunch of hashes. If you remember, the root user said in the chat that the password was a variant of the PleaseSubscribe! password. Let's create a custom wordlist with hashcat with variants of that password. First, let's put that password in the pwd file.

echo 'PleaseSubscribe!' > pwd

And now, let's create the custom wordlist with hashcat using the best64 rule, and put the output in the pwds file.

hashcat --stdout pwd -r /usr/share/hashcat/rules/best64.rule > pwds

  • --stdout don't crack a hash, instead print candidates only.

  • -r multiple rules applied to each word from wordlists.

Now, let's put the root hash in the hash file, and try to crack it with john, using the pwds wordlist.

john --wordlist=pwds hash

And we get the PleaseSubscribe!21 password. Now, all we have to do is become the root user, and reap the harvest and take the root flag.

su root

Last updated

Was this helpful?