> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/hack-the-box/linux/delivery-easy.md).

# Delivery (Easy)

## Summary

Delivery is a beginner-friendly box that does not require a lot of technical skills to solve. The foothold is about chaining logic flaws between OSTicket and Mattermost. The privesc is hashcat rule-based attack, based on a hint offered when getting the foothold.

## Nmap

![Nmap](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-826c13050440b116e76ff46d98c8f424b138d6e8%2Fimage.png?alt=media)

## Enumeration

Visit port 80. The "Contact Us" page has two links:

![Contact Us](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-e618b95aaea1363cca3b77de3377666c8ab5908d%2Fimage.png?alt=media)

To access these two links, edit `/etc/hosts`:

```
# HackTheBox
10.129.127.121 delivery.htb
10.129.127.121 helpdesk.delivery.htb
```

## User Shell: Chaining Logic Flaws

The idea is:

1. Create a ticket on OSTicket and get a `@delivery.htb` email address
2. Register an account on Mattermost using the `@delivery.htb` email address
3. Go back to OSTicket and abuse the "Check Ticket Status" feature to get the activation link from Mattermost

Grab the **activation link**:

![Activation link](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-4ade5eb8d4fe71270af7228a91d00031d6332494%2Fimage.png?alt=media)

Enter **Mattermost**:

![Mattermost](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-f59715c7e2b58c7211fcfbf8160721b5dbdadf6c%2Fimage.png?alt=media)

Here we learn that the credential is `maildeliverer:Youve_G0t_Mail!`. The comment on **hashcat** is the hint for privesc.

Login as the `maildeliverer` user through SSH:

![maildeliverer](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-bb58d537d44fbaacde70b774793a7c12965c4d59%2Fimage.png?alt=media)

## Privilege Escalation: hashcat Rule-based Attack

Search for the keyword "mattermost":

```bash
find / -name mattermost 2>/dev/null
```

In `/opt/mattermost/config/config.json`, we find a SQL credential `mmuser:Crack_The_MM_Admin_PW`:

![SQL credential in config.json](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-9c9b49d672fdf311d92ba296401bf6018eea7e7d%2Fimage.png?alt=media)

The password itself is also a hint. Login as `mmuser` through `mysql`:

```bash
mysql -u mmuser -p
```

The `Users` table from the `mattermost` database contains usernames and passwords:

![Database](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-bc84d5138c39945fc75d581bfbbdce760825743b%2Fimage.png?alt=media)

Dump the password of root:

```sql
MariaDB [mattermost]> SELECT Password from Users where Username="root";
+--------------------------------------------------------------+
| Password                                                     |
+--------------------------------------------------------------+
| $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO |
+--------------------------------------------------------------+
1 row in set (0.001 sec)
```

Identify hash type:

![Hash analyzer](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-dc6e57d5c6d5d5d48fa4df1ca9131a41cb451021%2Fimage.png?alt=media)

`bcrypt` hashes correspond to `3200` in hashcat:

![bcrypt](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-e51937e94abbeffad1b1ea62e607ca336731a184%2Fimage.png?alt=media)

Remember the hint from the Mattermost comment? Here we should use `PleaseSubscribe!` as wordlist and conduct the **hashcat rule-based attack**. hashcat documentation says:

> The **rule-based attack** is one of the most complicated of all the attack modes. The reason for this is very simple. The rule-based attack is like a **programming language** designed for password candidate generation. It has functions to **modify**, **cut** or **extend** words and has **conditional operators** to skip some, etc. That makes it the most flexible, accurate and efficient attack.

This idea is very similar to **mutation** in fuzzing.

The hashcat rules are located in `/usr/share/hashcat/rules`. For this box, we use `best64.rule`:

```bash
$ echo '$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO' > hash.txt
$ echo 'PleaseSubscribe!' > wordlist.txt
$ hashcat -a 0 -m 3200 hash.txt wordlist.txt -r /usr/share/hashcat/rules/best64.rule -o password.txt
```

The flags in the hashcat command represents:

* `-a 0`: set **attack mode** to "dictionary attack"
* `-m 3200`: set **hash type** to `bcrypt`
* `-r /usr/share/hashcat/rules/best64.rule`: use `best64.rule` to conduct **rule-based attack**
* `-o password.txt`: save the **output** to `password.txt`

Once the password is cracked, switch to the root user:

![root](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fgit-blob-652742a19eafee3f8c3aeb1d6c526a3d17e36963%2Fimage.png?alt=media)