Connected

Technical Walkthrough

Connected Walkthrough

Raw flags and reusable secrets are stored only under loot/.

Summary

<secret redacted> reached.

The live chain was:

1. Enumerate the validated FreePBX <TARGET> admin surface at /admin/.
2. Prove that same-origin browser headers remove the generic AJAX referrer gate.
3. Match the exact <secret redacted> route family from public CVE research against the live host:

- module=FreePBX\\modules\\endpoint\\ajax

- command=model

- template=x&model=model&brand=x

1. Use the matched endpoint chain to gain transient command execution as asterisk.
2. Read /home/asterisk/user.txt from that foothold and store it under loot/user.txt.
3. Remove the transient webshell and stop before privilege escalation.

Evidence

• State: target-state.json
• Notes: notes.md
• CVE route validation: enum/endpoint-watchtowr-shape-probe.txt
• Exploit run: exploits/watchtowr-run.txt
• Foothold baseline: loot/webshell-baseline.txt, loot/post-foothold-baseline.txt
• User flag: loot/user.txt

Stop Point

This run intentionally stops at <secret redacted> per operator instruction. Root/privesc work was not started.

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

Evidence Ledger

Synthesis

Current completion state: <secret redacted>.

Validated service surface:

• 22/tcp: OpenSSH 7.4
• 80/tcp: Apache httpd 2.4.6 on CentOS, redirecting to http://connected.htb/
• 443/tcp: Apache httpd 2.4.6 on CentOS, TLS cert CN=pbxconnect, http-robots.txt shows / disallowed, Nmap observed 404 Not Found for a request to config.php
• /admin/ over HTTPS is a FreePBX Administration login page with version string FreePBX <TARGET>
• /ucp/ is not a dead path; it is a real routed surface that hangs for at least 30 seconds
• /admin/cxpanel/ is also real and returns an application-level timeout message
• userman is live-proven by the accessible asset /admin/modules/userman/assets/js/adminPwdExpReminder.js
• endpoint is likely installed because /admin/modules/endpoint/module.xml exists but is access-controlled (403)
• Harmless userman AJAX controls are uniform and blocked by ajaxRequest declined - Referrer, even when loginpanel changes between admin and ucp
• Harmless endpoint controls are differentiated: module=endpoint&command= reaches the backend parser and returns a structured Ajax.class.php exception instead of the usual generic 403
• Browser-shaped headers remove the front-end gate: userman and endpoint both reach real auth/module logic when the request looks like a same-origin AJAX call
• The exact <secret redacted> route family module=FreePBX\\modules\\endpoint\\ajax&command=model... is live and reaches /admin/modules/endpoint/views/model.php
• Bounded exploitation of that route yielded transient command execution as asterisk
• /home/asterisk/user.txt is readable from the asterisk foothold and has been captured under loot/user.txt

Validated foothold chain:

1. FreePBX <TARGET> with the commercial endpoint module exposed the exact <secret redacted> route family.
2. A clean request to module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x proved the vulnerable path against the live host.
3. The matched CVE chain provided transient command execution as asterisk.
4. The asterisk foothold could directly read /home/asterisk/user.txt, which completed the <secret redacted> objective.

If resumed beyond <secret redacted>:

• Re-establish the transient endpoint foothold if needed.
• Start local privesc from the asterisk context, prioritizing localhost-only services (3306, 27017, 6379, 5038) and system/service config review.
• Do not treat <secret redacted> as COMPLETE; root work has not been started in this run.

Raw flags and reusable secrets must be stored only under loot/.

Attack Map

Completion State

<secret redacted>

Known Facts

Ranked Hypotheses

Decision Rule

The user objective is now <secret redacted>. Continue privesc only after re-establishing asterisk access and recording a privesc evaluator. Prefer the root-owned aiovega localhost service first; keep amportal as a secondary branch unless a stronger trigger is proven.

Session Resume

Last updated: 2026-06-08T21:37:23Z

Current Access

• Completion state: <secret redacted>.
• Machine: Connected.
• Category/status: seasonal active HTB machine.
• Difficulty/OS: Easy / Linux.
• Active target IP: <TARGET>.
• Prior stale target IP: <TARGET>.
• Current local workspace: <local workspace><TARGET>-Connected.
• Stale prior workspace: <local workspace><TARGET>-Connected.
• Pwnbox: profex0r@<TARGET>.
• Pwnbox password is intentionally not stored. Use <secret redacted> only at runtime.
• Attacker/VPN IP: <TARGET>.
• Hostname/domain: connected.htb discovered from the live HTTP redirect.
• Route to <TARGET> is validated via tun0.
• Live service map is validated: 22/tcp, 80/tcp, 443/tcp.
• /admin/ is a validated FreePBX admin login page.
• Product/version anchor: FreePBX <TARGET>.
• Related exposed routes seen in source: /ucp, cxpanel, config.php?display=cxpanel_menu.
• /ucp/ is a real routed surface, but it hangs for at least 30 seconds with no bytes returned.
• /admin/cxpanel/ is also real and responds with an application message: Offline system! Resolving timed out after 5516 milliseconds.
• userman is present, proven by a directly accessible JS asset under /admin/modules/userman/.
• endpoint is likely installed because /admin/modules/endpoint/module.xml exists and returns 403, while /admin/modules/endpointman/module.xml is 404.
• Harmless userman AJAX controls are uniform and blocked by ajaxRequest declined - Referrer for both loginpanel=admin and loginpanel=ucp.
• Harmless endpoint route controls are differentiated: module=endpoint&command= reaches backend parsing and throws a structured Ajax.class.php exception, while adjacent endpoint controls fall back to generic 403 responses.
• Browser-shaped headers remove the front-end AJAX gate and reach real auth/module logic.
• The exact <secret redacted> route family module=FreePBX\\modules\\endpoint\\ajax&command=model... is live and reaches endpoint/views/model.php.
• The endpoint chain yielded transient command execution as asterisk.
• user.txt has been captured from /home/asterisk/user.txt and stored as loot/user.txt.
• The transient webshell has been removed and now returns 404.
• The prior amportal / incrond branch was validated further: amportal resolves the first writable freepbx_engine from /var/lib/asterisk/bin, but the bounded trigger attempt did not yield a readable root copy before restore.
• A stronger root lead exists locally: enum/privesc-amportal-deep-check.txt shows a root-owned loopback service, /usr/bin/python3.6 -m aiohttp.web aiovega.web:app_factory -H <TARGET> -P 4000.
• Current live blocker: the coordinator cannot reach the Pwnbox (<TARGET>) over ICMP or TCP/22, and the local Mac still has no direct route to <TARGET>.

Prior Context To Avoid Repeating

The previous Connected workspace targeted <TARGET> and stalled before service enumeration because the target had no reachable service surface:

• ping failed or returned no replies,
• common ports stayed filtered/no-response,
• full TCP produced no open ports,
• HTB UI verification was inconclusive.

Treat that as stale spawn/IP/lab-state context only. Do not reuse it as evidence for <TARGET>.

Immediate Objective

Resume from <secret redacted> to <secret redacted> once transport is restored.

Next Three Actions

1. Restore the live transport path: regain Pwnbox SSH or update the active Pwnbox details if HTB reassigned it.
2. Re-establish the endpoint foothold as asterisk, then dump or inspect aiovega.web from the live target.
3. Record a new privesc evaluator before probing the root-owned localhost aiovega service; fall back to amportal only if a real root-side trigger is proven.

Stop Conditions

Stop and report instead of continuing if:

• Pwnbox SSH to <TARGET> remains unreachable and no replacement Pwnbox details are available.
• Target IP in HTB UI differs from <TARGET>.
• connected.htb / pbxconnect behavior diverges from the currently captured FreePBX admin and UCP/cxpanel surfaces.
• Product-specific research claims do not match the validated FreePBX <TARGET> plus userman / endpoint evidence, or do not explain the observed referrer/parser behavior.
• A public research claim cannot be validated against live target evidence.

Session Registry

Dead Ends

Stale Prior IP Branch

Active Dead Ends

Attack Map

Completion State

COMPLETE

Known Facts

Ranked Hypotheses

Decision Rule

The current target is the respawned <TARGET> instance. Historical work from <TARGET> remained advisory only until revalidated. The final active chain on <TARGET> was:

1. Revalidate FreePBX endpoint route anchors.
2. Reuse the endpoint CVE to regain transient asterisk execution.
3. Prove the root-side sysadmin_manager watched-filename pipe injection with a harmless marker.
4. Use the same root-side filename pipeline to create /ROOTTAR from /root.
5. Read root/root.txt from that archive into loot/root.txt.
6. Remove /ROOTTAR and validation artifacts.
7. Verify there are no remaining watchTowr cron rows and remove the active webshell.

Memory Summary

Connected (<TARGET> respawn) reached COMPLETE by revalidating the FreePBX <TARGET> endpoint CVE foothold and then pivoting to a stronger local privesc than the earlier amportal/dnsmasq ideas. The durable lesson is that /usr/bin/sysadmin_manager on this image concatenates watched-filename params into system("$hookfile $params") while missing pipe |, and root-owned incrond watches /usr/local/asterisk/incron with <secret redacted>. A harmless watched filename proved root-side command execution, and a watched filename |tar cf ROOTTAR root produced a readable root-owned tar archive that allowed root/root.txt recovery through the existing asterisk foothold. Cleanup mattered: remove /ROOTTAR and validation markers, confirm no leftover watchTowr cron rows, delete the active webshell, and verify the old URL returns 404.