> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/delivery-hackthebox-writeup.md). # Delivery HackTheBox Writeup Delivery HackTheBox Easy Linux machine writeup covering Virtual Hosting Enumeration, Abusing Support Ticket System, Access to MatterMost, Information Leakage, with practical enumeration, exploitation, {% embed url="" %} {% hint style="warning" %} **Skills:** * Virtual Hosting Enumeration * Abusing Support Ticket System * Access to MatterMost * Information Leakage * Database Enumeration - MYSQL * Cracking Hashes * Playing with hashcat rules in order to create passwords * Playing with sucrack to find out a user's password {% endhint %} ## Reconnaissance **Workspace Setup:** Set up the workspace by creating three folders to store important content, exploits, and Nmap reconnaissance results.

**VPN Connectivity Check** Check VPN connectivity to ensure stable communication with the target machine.

**Open Port Discovery with Nmap:** Enumerate open ports and export the results to the "allPorts" file in the Nmap directory: ```bash nmap -p- --open -sS -n -Pn --min-rate 5000 -vvv 10.10.10.222 -oG allPorts ```

**Open Port Analysis with extractPorts:** Use the extractPorts function to display open ports in a concise format and copy them to the clipboard (22,80,8085)

**Port Version Scan with Nmap:** Use Nmap to scan service versions and save the output in the "targeted" file: ```bash nmap -sCV -p22,80,8065 10.10.10.222 -oN targeted ```

### Port 80:

**Identification of information with WhatWeb:** Running WhatWeb reveals a user **jane** with the email address ****. ```bash whatweb 10.10.10.222 ```

We also find a domain **delivery.htb** and a subdomain **helpdesk.delivery.htb**.

**Configuration of the /etc/hosts file** We add the target's IP address to our `/etc/hosts` file to facilitate local DNS resolutions.

## **Support Center - HelpDesk :** The `helpdesk.delivery.htb` subdomain allows you to create support tickets. We are trying to create an account with the following information:

**Opening a Ticket** * `jordan@delivery.com`

A new ticket is opened, and we receive an email containing an identifier: * **Email** : <7990131@delivery.htb> * **Ticket ID**: 7990131

When checking the ticket, we use our own email address (****), although we did not create it, as well as the number of the ticket received (**7990131**).

This allows us to access the associated mailbox.

### Port 8065 - Mattermost **Discovery of Mattermost:** Port **8065** hosts a **Mattermost** CMS.

**Attempting to create an account:** We are trying to create an account, we then use the email address: <7990131@delivery.htb> name: jordan1 password Jordan1234#

We receive a verification message containing a **token** to activate the account:

{% code overflow="wrap" %} ``` http://delivery.htb:8065/do_verify_email?token=hs36amqfpkm3hcguxsmrton83e7a9k7xp595rga6zhwzd35awf1krpftfqink3go&email=7990131%40delivery.htb ``` {% endcode %}

After validation, we connect with our credentials and access the Mattermost **management panel**.

**Recovery of credentials** In the **"Switch Channels"** section we find a message containing a username and password: * **Username**: `maildeliverer` * **Password**: Youve/\_G0t/\_Mail!

We then attempt an SSH connection with these credentials: ```bash ssh maildeliverer@delivery.htb ```

### Flag user.txt :)

## **Privilege Escalation** We go to the root of the system, in the `/var/www/html/osticket` folder, and we filter by the word **password**: ```bash grep -ir "password" ``` We don't find anything interesting. We will now search for information for **Mattermost** by filtering the running processes: ```bash ps -faux ```

We notice that Mattermost is installed in `/opt` and find a **config.json** file.

Opening it, we discover credentials for the SQL database:

* Username: `mmuser` * Password: `Crack_The_MM_Admin_PW` ### Connecting to MySQL We use these credentials to connect to the database: ```bash mysql -u mmuser -p ``` We list the databases: ```sql show databases; use mattermost ```

We list the available tables and describe the structure of the **Users** table: ```sql show tables; describe Users; ```

Finally, we select the **Username** and **Password** columns: ```sql select Username, Password from Users; ``` We then find the **hash of root's password:** `$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO`

### 1. Brute Force - Hash We use **hashid** to identify the hash type: ```bash hashid hash ```

The hash is identified as **bcrypt**. With **John the Ripper**, we will launch a brute force attack by specifying the **bcrypt** format: ```bash john --format=bcrypt hash -w /usr/share/wordlists/rockyou.txt ``` However, it doesn't work with **rockyou.txt**, no password found.

Observing the group chat, we notice that they directly say that the password **"PleaseSubscribe!"** is reused. This password does not appear in **rockyou.txt**, but a hacker could use **hashcat** to generate variations.

### Password Variants - Hashcat **Generation of variants with Hashcat** With **hashcat**, we will create variations of the password: ```bash hashcat --stdout -r /usr/share/hashcat/rules/best64.rule password ```

We will then attempt to crack the hash using **hashcat** and the new dictionary: ```bash hashcat -m 3200 -a 0 hash passwords ``` The password found is: **PleaseSubscribe!21**

### 2. Brute Force on "su" - sucrack We will launch an attack against **su**: ```bash sucrack -w 20 -u root passwords ```

It tells us that the password is correct: **PleaseSubscribe!21** We successfully log in as **root**.

### Flag root.txt :)

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/writeups-ctf/hackthebox/linux-easy/delivery-hackthebox-writeup.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.