Enumeration

maildeliverer@Delivery:/var/www/osticket/scripts$ netstat
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 localhost:35220         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35222         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35226         ESTABLISHED
tcp        0      0 localhost:35222         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:35228         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:35224         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35218         ESTABLISHED
tcp        0      0 localhost:35216         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35220         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35224         ESTABLISHED
tcp        0      0 localhost:35226         localhost:mysql         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35228         ESTABLISHED
tcp        0      0 localhost:mysql         localhost:35216         ESTABLISHED

MySQL is running.

Remember the agent login page: http://helpdesk.delivery.htb/scp/login.php

So this page seems interesting (we know its running nginx and this is the root directory):

maildeliverer@Delivery:/var/www/osticket/upload/scp$ ls
admin.inc.php  apps          canned.php      departments.php    emailtest.php  forms.php       js         logo.php    pages.php    queues.php     slas.php       tasks.php      upgrade.php
admin.php      audits.php    categories.php  directory.php      export.php     helptopics.php  kb.php     logout.php  plugins.php  roles.php      staff.inc.php  teams.php      users.php
ajax.php       autocron.php  css             emailsettings.php  faq.php        images          lists.php  logs.php    profile.php  schedules.php  staff.php      templates.php
apikeys.php    banlist.php   dashboard.php   emails.php         filters.php    index.php       login.php  orgs.php    pwreset.php  settings.php   system.php     tickets.php

Couldnt find anything interesting here.

Checking Mattermost apps directory, the default is /opt/mattermost according to the docs.

Inside /opt/mattermost/config/config.json file we find MySQL credentials:

We can log into mysql:

This will give us the Users table where we find columns 'username' and 'password'

PreviousFootholdNextPrivEsc

Last updated