infraProeasy

Enigma

hackthebox

Task: Compromise an HTB Linux machine exposing NFS, mail, and a vulnerable support portal. Solution: harvest onboarding credentials from anonymous NFS, pivot through reused mailbox passwords into OpenSTAManager RCE, then abuse OliveTin local action injection for root.

nfs roundcube imap password_reuse openstamanager cve_2025_69212 command_injection webshell mysql bcrypt_cracking su_pivot olivetin local_api privilege_escalation suid

nfs_share_enumerationcredential_harvestingmailbox_pivotingpassword_reusep7m_filename_command_injectionwebshell_deploymentmysql_config_leakbcrypt_hash_crackinglocal_api_command_injectionsuid_binary_creation

$ ls tags/ techniques/

nfs roundcube imap password_reuse openstamanager cve_2025_69212 command_injection webshell mysql bcrypt_cracking su_pivot olivetin local_api privilege_escalation suid

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups