Hacking Insights by Max Bautista

Solidstate writeup

Box name: SolidState

Difficulty: Medium

OS: Linux

Overview: SolidState is a medium difficulty machine that requires chaining of multiple attack vectors in order to get a privileged shell. As a note, in some cases the exploit may fail to trigger more than once and a machine reset is required.

Link: https://app.hackthebox.com/machines/SolidState?sort_by=created_at&sort_type=desc

Machine IP: 10.129.94.187

Ran rustscan to scan the target machine.

rustscan -a 10.129.94.187 –ulimit 5000 -b 500 — -A -Pn

Navigated to the website first.

No robots.txt or anything interesting in source code. Kicked off feroxbuster.

feroxbuster -u http://10.129.94.187 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion -t 50 -d 4 –filter-status 404,400

I poked around the webserver a bit further but couldn’t find anything entertaining. I’ve never seen port 4555 but when I googled it I found this https://www.ibm.com/docs/en/webmethods-integration/wm-infrastructure/10.15.0?topic=transport-setting-up-apache-james-server. This appears to be an Apache James server. With telnet we confirmed this is true.

Upon further research we see this is vulnerable to an RCE exploit https://www.exploit-db.com/exploits/35513/. This executes when someone logs in though.

penelope -p 4444

python2 james.py 10.129.94.187

Connected back to the server and checked out the commands with HELP. With list user we can see the users.

I was able to change the password of mindy.

Upon logging into Mindy we see that there are credentials for SSH.

telnet 10.129.94.187 110

USER mindy

PASS kamipwn

LIST

RETR 2

mindy:P@55W0rd1!2@

ssh mindy@10.129.94.187

And we get a shell and user.txt

Started local enumeration. In /opt there is a root owned by root called tmp.py.

Checked if this is running and we can see it is.

Edited it to run a reverse shell.

penelope -p 4445

After a minute or so we get root and the root flag.

GG

Attack Chain

1 – Reconnaissance
Ran RustScan and identified several ports including 80 (HTTP), 110 (POP3), and 4555 (unusual, unfamiliar). Browsed to the web server with nothing interesting in source code or robots.txt. Ran feroxbuster with no useful findings. Researched port 4555 and identified it as a management port for Apache James mail server. Confirmed this via telnet.

rustscan -a 10.129.94.187 –ulimit 5000 -b 500 — -A -Pn
feroxbuster -u http://10.129.94.187 -w /usr/share/seclists/Discovery/Web-Content/raft-large-words.txt -x php,html,txt,bak,zip,json,xml,py,sh,config –force-recursion

2 – Initial Access – Apache James RCE – EDB-35513
Researched Apache James and found EDB-35513, a remote code execution vulnerability triggered on user login via a crafted message. Set up a listener and ran the public exploit against port 4555. Connected to the management port and used the LIST USER and SETPASSWORD commands to change mindy’s password.

python2 james.py 10.129.94.187

3 – POP3 credential disclosure and SSH access
Logged into mindy’s mailbox via POP3 using the newly set password and found SSH credentials stored in an email message. Authenticated via SSH with the recovered credentials. Retrieved user.txt.

telnet 10.129.94.187 110
USER mindy
PASS kamipwn
RETR 2

Credentials recovered: mindy:P@55W0rd1!2@

4 – Privilege Escalation – writable root-owned cron script
Enumerated /opt and found tmp.py, owned by root. Confirmed it was being executed on a schedule. Edited the script to include a reverse shell payload and waited for the cron job to trigger. Caught a root shell. Retrieved root.txt.

---

Key Takeaways

1. Apache James remote code execution – EDB-35513 (CVSS 9.8 Critical) – The Apache James mail server exposed an unauthenticated management interface on port 4555 that allowed resetting any user’s password and triggering code execution on login via a crafted message. Mail server management interfaces must require strong authentication and must never be exposed to untrusted networks.
   
2. Mail server management port exposed without authentication – Port 4555 accepted connections and administrative commands with no authentication required, allowing direct password resets for any mailbox. Administrative interfaces for mail servers must be bound to localhost or a dedicated management network and must require authentication for any state-changing action.
   
3. SSH credentials stored in plaintext inside an email message – Mindy’s SSH credentials were found in plaintext within a POP3 mailbox message. Credentials must never be transmitted or stored via email in plaintext and must be delivered through a secure credential management channel.
   
4. Root-owned script in /opt writable by a standard user – The tmp.py script executed on a schedule as root but was writable by the mindy account, allowing arbitrary code execution in a root context. Scripts and files executed by privileged scheduled tasks must be owned by root with no write access for any other account.
   
5. Cron job execution providing a reliable privilege escalation path – Writable root-owned scripts executed via cron are a critical and commonly recurring privilege escalation vector. Cron job configurations and their referenced scripts must be audited regularly for incorrect file ownership and permissions.
   

---

Remediation

[Immediate] Patch Apache James to remediate EDB-35513 (CVSS 9.8 Critical)
Update Apache James to the latest supported version immediately. If the software is end of life or unmaintained, replace it with a supported mail server platform. Restrict access to port 4555 to localhost or an authorized management network via firewall rules, and require authentication for all administrative commands.

[Immediate] Fix permissions on tmp.py and audit all cron-executed scripts
Set tmp.py to be owned by root with mode 700, removing write access from mindy and all other non-root accounts. Audit all scripts referenced in cron jobs and systemd timers across the system for incorrect ownership or world/group writable permissions, and correct any findings.

[Immediate] Rotate mindy’s credentials and remove them from the mailbox
Rotate mindy’s SSH password immediately and delete the message containing plaintext credentials from the mailbox. Audit all mailboxes on the system for stored credential material and remove any findings.

[Short-term] Restrict mail server administrative access
Apply the principle of least privilege to the Apache James management interface, limiting access to a small set of authorized administrator accounts and source IPs. Enable logging and alerting on all password reset and administrative command activity.

[Long-term] Implement a mail server hardening baseline and cron audit program
Define a hardening standard for all mail server deployments covering management port exposure, authentication requirements, and patch cadence. Establish a recurring audit of all cron jobs and scheduled tasks across the environment to detect writable scripts referenced by privileged processes. Include mail server administrative interfaces and scheduled task permissions in the regular penetration testing scope.