Skip to content



Looks like there are two web servers running in the machine, I will start checking port 80 first and then we can go with the 8065. I know SSH is there but since I have no credentials and the version is not too old let's move on for now.

└─$ sudo nmap -p- --min-rate=1000
Starting Nmap 7.93 ( ) at 2023-02-01 18:04 CET
Nmap scan report for
Host is up (0.048s latency).
Not shown: 65532 closed tcp ports (reset)
22/tcp   open  ssh
80/tcp   open  http
8065/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 19.39 seconds

└─$ sudo nmap -p22,80,8065 -sC -sV
Starting Nmap 7.93 ( ) at 2023-02-01 18:06 CET
Nmap scan report for (
Host is up (0.041s latency).

22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
| ssh-hostkey: 
|   2048 9c40fa859b01acac0ebc0c19518aee27 (RSA)
|   256 5a0cc03b9b76552e6ec4f4b95d761709 (ECDSA)
|_  256 b79df7489da2f27630fd42d3353a808c (ED25519)
80/tcp   open  http    nginx 1.14.2
|_http-title: delivery
|_http-server-header: nginx/1.14.2
8065/tcp open  unknown
| fingerprint-strings: 
|   GenericLines, Help, RTSPRequest, SSLSessionReq, TerminalServerCookie: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Accept-Ranges: bytes
|     Cache-Control: no-cache, max-age=31556926, public
|     Content-Length: 3108
|     Content-Security-Policy: frame-ancestors 'self'; script-src 'self'
|     Content-Type: text/html; charset=utf-8
|     Last-Modified: Wed, 01 Feb 2023 16:59:37 GMT
|     X-Frame-Options: SAMEORIGIN
|     X-Request-Id: sz4pfpnxf38t7j84ks8rsrhn8w
|     X-Version-Id:
|     Date: Wed, 01 Feb 2023 17:06:38 GMT
|     <!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,user-scalable=0"><meta name="robots" content="noindex, nofollow"><meta name="referrer" content="no-referrer"><title>Mattermost</title><meta name="mobile-web-app-capable" content="yes"><meta name="application-name" content="Mattermost"><meta name="format-detection" content="telephone=no"><link re
|   HTTPOptions: 
|     HTTP/1.0 405 Method Not Allowed
|     Date: Wed, 01 Feb 2023 17:06:38 GMT
|_    Content-Length: 0

Service detection performed. Please report any incorrect results at .
Nmap done: 1 IP address (1 host up) scanned in 94.44 seconds

Port 80

We have a pretty simple website http://delivery.htb/ (Remember to add the domain to your host file!) where the only interesting thing was a link to The virtual host is serving a Osticket application for ticketing, looks updated and the staff login in is not accepting the default credentials so I guess that is time to keep going.

Port 8065

A Mattermost installation, again looks updated. I can register but I need to confirm my email, that is a problem because I'm not really able to get the email... or maybe I can. Well, the help desk application, when creating a ticket, provides a custom @delivery.htb email that we can use to send updates to the ticket thread.

Since we have access to that thread, we could use that ticket email for Mattermost registration and get our confirmation email in the ticket thread! As you can see, we can now confirm our account:

---- Registration Successful ---- Please activate your email by going to: http://delivery.htb:8065/do_verify_email?token=zzsen61145xqsq68ya3k6wtipt9wnb5e9yxupcd9pkfmyoisaw3ngc7qwxw6tm6z&email=9517485%40delivery.htb ) --------------------- You can sign in from: --------------------- Mattermost lets you share messages and files from your PC or phone, with instant search and archiving. For the best experience, download the apps for PC, Mac, iOS and Android from: (

Cool, inside Mattermost I can join a team called Internal. There, I got credentials for SSH maildeliverer:Youve_G0t_Mail!.

In the box

Getting some hashes

After an initial enumeration trying to find low hanging fruits, I decided to look into the MySQL database that is running in the system. For that, we can just go to the Mattermost configuration directory and get the credentials for it. Fun fact, the password to access the database is actually a hint for the next step.

maildeliverer@Delivery:/var/www/osticket$ netstat -ltpn
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0*               LISTEN      -                   
tcp        0      0    *               LISTEN      -                   
tcp        0      0    *               LISTEN      -                   
tcp        0      0 *               LISTEN      -                   
tcp        0      0*               LISTEN      -                   
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
tcp6       0      0 ::1:631                 :::*                    LISTEN      -                   
tcp6       0      0 :::8065                 :::*                    LISTEN      - 

maildeliverer@Delivery:/opt/mattermost/config$ cat config.json | grep mysql -A 10
        "DriverName": "mysql",
     -->"DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(,utf8\u0026readTimeout=30s\u0026writeTimeout=30s",
        "DataSourceReplicas": [],
        "DataSourceSearchReplicas": [],
        "MaxIdleConns": 20,
        "ConnMaxLifetimeMilliseconds": 3600000,
        "MaxOpenConns": 300,
        "Trace": false,
        "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez",
        "QueryTimeout": 30,
        "DisableDatabaseSearch": false

Inside MySQL, I searched for the Mattermost user table and looks like there is a user called root registered. If that is the same root as in the system and we can crack the password we win!

MariaDB [mattermost]> select Username,Password from Users;
| Username                         | Password                                                     |
|...                                                                                              |
| root                             | $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
|...                                                                                              |


The Rockyou dictionary failed to crack the password but in the Mattermost chat, there is a comment about not using passwords like: PleaseSubscribe! or variants of it. Maybe, using some rules and that password could be enough to crack it.

After some try and error, I was able to crack the hash using Hashcat and the rule called rockyou-30000.rule. The password is PleaseSubscribe!21 and we can use it to escalate to root!