Connected

Technical Walkthrough

Connected Walkthrough

Raw flags and reusable secrets are stored only under loot/.

Summary

The live respawn at <TARGET> still exposed FreePBX <TARGET> on connected.htb, so the previously validated endpoint branch remained the fastest initial access path. I revalidated the exact endpoint route family, reused the <secret redacted> chain to regain transient asterisk execution, and recaptured user.txt.

For privesc, the strongest live branch was not amportal or dnsmasq. The decisive source-backed primitive was root-owned incrond plus /usr/bin/sysadmin_manager. sysadmin_manager concatenates watched-filename params into system("$hookfile $params"), and its metacharacter filter misses pipe |. A harmless watched filename under /usr/local/asterisk/incron created a root-owned marker, then a watched filename sysadmin.dump-iptables.|tar cf ROOTTAR root created a readable root-owned tar archive. From the asterisk foothold I extracted root/root.txt from that archive into loot/root.txt.

After objective capture, I removed /ROOTTAR and the validation markers, verified asterisk.cron_jobs had no remaining watchTowr rows, deleted the active webshell file, and confirmed the old URL returned 404 Not Found.

Evidence

• State: target-state.json
• Notes: notes.md
• Route + surface revalidation: enum/pwnbox-preflight-respawn.txt, enum/ping-common-respawn.txt, enum/admin-source-respawn.txt, enum/endpoint-watchtowr-shape-probe-respawn.txt
• Root hook source and watcher proof: enum/incron-watcher-source.txt, enum/sysadmin-hook-sources-live.txt, enum/local-incron-filename-pipe-marker.txt
• Root copy-out proof: enum/local-incron-tar-validation.txt, enum/root-tar-seed.txt, loot/root.txt
• Cleanup proof: loot/privesc-cleanup.txt, enum/cron-jobs-cleanup-check.txt, loot/webshell-post-clean-status.txt, enum/webshell-body-after-cleanup.txt

Source-Backed Dossier

The sections below are merged from companion Markdown notes for the same case. They are rendered after sanitization so the article stays precise without publishing raw flags, credentials, or target-specific secrets.

Notes

Scope

Evidence Ledger

Synthesis

Current completion state: COMPLETE.

The active respawn matched the prior instance at the high-value anchors needed to reuse the old endpoint chain, and the root branch is now fully live-proven:

• 22/tcp, 80/tcp, 443/tcp are open
• connected.htb still redirects to /admin
• /admin/ still identifies FreePBX <TARGET>
• /ucp, cxpanel, and the userman asset references are still present
• the exact endpoint exploit route still resolves and differentiates correctly
• incrond runs as root and watches /usr/local/asterisk/incron with <secret redacted>
• sysadmin_manager still concatenates the watched filename params into system("$hookfile $params")
• the parameter filter blocks several metacharacters but not pipe |
• a watched filename payload created /<secret redacted> as root
• a watched filename payload created /ROOTTAR as a readable root-owned tar archive
• root/root.txt was extracted from that archive into loot/root.txt
• asterisk.cron_jobs has no remaining watchTowr rows on the active respawn
• the active endpoint webshell file was removed and the old URL now returns 404 Not Found

Historical evidence from <local workspace><TARGET>-Connected remained advisory only until revalidated on <TARGET>. The final privesc chain on the active respawn is fully backed by live files under enum/ and loot/.

Raw flags and reusable secrets must be stored only under loot/.

Attack Map

Completion State

COMPLETE

Known Facts

Ranked Hypotheses

Decision Rule

The current target is the respawned <TARGET> instance. Historical work from <TARGET> remained advisory only until revalidated. The final active chain on <TARGET> was:

1. Revalidate FreePBX endpoint route anchors.
2. Reuse the endpoint CVE to regain transient asterisk execution.
3. Prove the root-side sysadmin_manager watched-filename pipe injection with a harmless marker.
4. Use the same root-side filename pipeline to create /ROOTTAR from /root.
5. Read root/root.txt from that archive into loot/root.txt.
6. Remove /ROOTTAR and validation artifacts.
7. Verify there are no remaining watchTowr cron rows and remove the active webshell.

Memory Summary

Connected (<TARGET> respawn) reached COMPLETE by revalidating the FreePBX <TARGET> endpoint CVE foothold and then pivoting to a stronger local privesc than the earlier amportal/dnsmasq ideas. The durable lesson is that /usr/bin/sysadmin_manager on this image concatenates watched-filename params into system("$hookfile $params") while missing pipe |, and root-owned incrond watches /usr/local/asterisk/incron with <secret redacted>. A harmless watched filename proved root-side command execution, and a watched filename |tar cf ROOTTAR root produced a readable root-owned tar archive that allowed root/root.txt recovery through the existing asterisk foothold. Cleanup mattered: remove /ROOTTAR and validation markers, confirm no leftover watchTowr cron rows, delete the active webshell, and verify the old URL returns 404.

Session Resume

Last updated: 2026-06-09T05:46:00Z

Current Access

• Completion state: COMPLETE.
• Machine: Connected.
• Category/status: seasonal active HTB machine.
• Difficulty/OS: Easy / Linux.
• Active target IP: <TARGET>.
• Prior stale target IPs: <TARGET>, <TARGET>.
• Current local workspace: <local workspace><TARGET>-Connected.
• Superseded prior workspace: <local workspace><TARGET>-Connected.
• Pwnbox: profex0r@<TARGET>.
• Pwnbox password is intentionally not stored. Use <secret redacted> only at runtime.
• Attacker/VPN IP: <TARGET>.
• Hostname/domain: connected.htb.
• Route to <TARGET> is validated via tun0.
• Live service map on the respawn stayed consistent at 22/tcp, 80/tcp, 443/tcp.
• /admin/ is again a validated FreePBX admin login page.
• Product/version anchor on the respawn: FreePBX <TARGET>.
• The transient endpoint webshell foothold was reused to reach asterisk, then removed after cleanup.
• incrond runs as root and watches /usr/local/asterisk/incron with <secret redacted>.
• sysadmin_manager concatenates watched-filename params into system("$hookfile $params").
• The parameter filter blocks several shell metacharacters but misses pipe |.
• A harmless watched filename created /<secret redacted> as root.
• A watched filename |tar cf ROOTTAR root created /ROOTTAR as a readable root-owned tar archive.
• tar xf /ROOTTAR -O root/root.txt recovered the live root flag into loot/root.txt.
• Privesc cleanup removed /ROOTTAR, /ETCTAR, /<secret redacted>, and temporary marker files.
• asterisk.cron_jobs has zero rows matching the watchTowr artifact patterns.
• The old webshell URL now returns 404 Not Found.

Immediate Objective

Stop. The machine is complete on the active respawn; both user.txt and root.txt are captured locally and the live exploit artifacts were cleaned.

Next Three Actions

1. Keep loot/root.txt, loot/user.txt, loot/privesc-cleanup.txt, and loot/webshell-post-clean-status.txt as the authoritative local evidence refs.
2. Do not resume exploitation on this respawn unless the operator explicitly asks for replay or extra validation.
3. On a future respawn, start with route/Pwnbox validation and re-check the watched-filename root hook before assuming the same branch still works.

Stop Conditions

Stop and report instead of continuing if:

• The target respawns again and invalidates the current loot/ evidence.
• Any later task would require replaying the root chain without a fresh route/Pwnbox validation.

Session Registry

Attack Map

Completion State

<secret redacted>

Known Facts

Ranked Hypotheses

Decision Rule

The user objective is now <secret redacted>. Continue privesc only after re-establishing asterisk access and recording a privesc evaluator. Prefer the root-owned aiovega localhost service first; keep amportal as a secondary branch unless a stronger trigger is proven.

Dead Ends

Stale Prior IP Branch

Active Dead Ends