HTB — Delivery

I Learned from HTB Delivery

During this machine, I practised several important penetration-testing techniques:

• Nmap: Port scanning and service enumeration.
• Web Enumeration: Discovering and investigating Mattermost.
• Information Disclosure: Extracting sensitive information from internal chat messages.
• Credential Discovery: Identifying exposed credentials.
• Linux Enumeration: Exploring configuration files and directories.
• MySQL: Connecting to and exploring application databases.
• Hash Identification: Identifying bcrypt password hashes.
• Password Auditing: Using John the Ripper and Hashcat.

Key Takeaway: Learned how information disclosure, weak credential management, and exposed configuration files can create security risks in real-world applications.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #Linux #Nmap #MySQL #JohnTheRipper #Hashcat #EthicalHacking

As like always let's start with some reconnaissance using nmap. Here :

Exploring port 80

3&4

So on logging in we are directed to go to internal where we find an announcement which exposes creds for osTicket Agent

With some googling "Mattermost is an open-source, self-hostable online chat service with file sharing, search, and integrations. It is designed as an internal chat for organisations and companies, and mostly markets itself as an open-source alternative to Slack and Microsoft Teams"

User:

So let's login to mysql as this user

Now seeing the databases: show databases;

why it is bcrypt hash

Understand the hash bcrypt

Component $2a$

algorithm version 10

RooT:

maildeliverer@Delivery:/opt/mattermost/config$ su root Password: root@Delivery:/opt/mattermost/config# id uid=0(root) gid=0(root) groups=0(root)

root@Delivery:/opt/mattermost/config# cd ..

root@Delivery:/opt/mattermost# ls -la total 288 drwxrwxr-x 12 mattermost mattermost 4096 Jul 14 2021 . drwxr-xr-x 3 root root 4096 Jul 14 2021 .. drwxrwxr-x 2 mattermost mattermost 4096 Dec 18 2020 bin drwxrwxr-x 7 mattermost mattermost 4096 Dec 26 2020 client drwxrwxr-x 2 mattermost mattermost 4096 Dec 26 2020 config drwxrwxr-x 3 mattermost mattermost 4096 Nov 3 13:17 data -rw-rw-r — 1 mattermost mattermost 2052 Dec 18 2020 ENTERPRISE-EDITION-LICENSE.txt drwxrwxr-x 2 mattermost mattermost 4096 Dec 18 2020 fonts drwxrwxr-x 2 mattermost mattermost 4096 Dec 18 2020 i18n drwxrwxr-x 2 mattermost mattermost 4096 Dec 26 2020 logs -rw-rw-r — 1 mattermost mattermost 898 Dec 18 2020 manifest.txt -rw-rw-r — 1 mattermost mattermost 229264 Dec 18 2020 NOTICE.txt drwxr — r — 5 mattermost mattermost 4096 Nov 3 13:22 plugins drwxrwxr-x 2 mattermost mattermost 4096 Dec 18 2020 prepackaged_plugins -rw-rw-r — 1 mattermost mattermost 6262 Dec 18 2020 README.md drwxrwxr-x 2 mattermost mattermost 4096 Dec 18 2020 templates

root@Delivery:/opt/mattermost# cd

root@Delivery:~# ls -la total 48 drwx — — — 5 root root 4096 Nov 3 13:17 . drwxr-xr-x 19 root root 4096 Jul 14 2021 .. lrwxrwxrwx 1 root root 9 Dec 28 2020 .bash_history -> /dev/null -rw-r — r — 1 root root 570 Jan 31 2010 .bashrc drwxr-xr-x 3 root root 4096 Jul 14 2021 .cache drwx — — — 3 root root 4096 Jul 14 2021 .gnupg -rwxr-x — — 1 root root 103 Dec 26 2020 mail.sh -r — — — — 1 root root 382 Dec 28 2020 note.txt -rw-r — — — 1 root root 148 Aug 17 2015 .profile -rw-r — — — 1 root root 1499 Dec 26 2020 py-smtp.py -r — — — — 1 root root 33 Nov 3 13:17 root.txt drwxr-xr-x 2 root root 4096 Jul 14 2021 .vim -rw — — — — 1 root root 1209 Jul 14 2021 .viminfo

root@Delivery:~# cat root.txt be753ab859d9f73cfbf529fa94658225