OpenAdmin — HTB Writeup | The Hack Sparrow

Executive summary — OpenAdmin is an Easy Linux box with a long, instructive credential-reuse chain: an unauthenticated RCE in OpenNetAdmin 18.1.1 (CVE-2019-3980); cleartext DB credentials reused for SSH (jimmy); an internal web app, reachable only on localhost, that leaks joanna's SSH key (whose passphrase we crack with John); and a final escalation via sudo nano (GTFOBins). An ONA RCE → jimmy → joanna → sudo nano → root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.23.183`

Attack map

[80/HTTP] Apache 2.4.29 → dirsearch → /music → /ona/  = OpenNetAdmin 18.1.1
   │  CVE-2019-3980 (EDB-47691) — unauthenticated xajax command injection → www-data
   ▼
[FILE] database_settings.inc.php → ona_sys:n1nj4W4rri0R! (cleartext, reused)
   ▼
[SSH]  jimmy
   │  internal group → /var/www/internal (main.php) served on localhost:52846
   │  main.php leaks joanna's id_rsa (shell_exec)
   ▼
[SSH]  joanna  (cracked «bloodninjas» passphrase with John/rockyou)  → user.txt
   │  sudo -l → (ALL) NOPASSWD: /bin/nano /opt/priv
   ▼
[ROOT]  nano → Ctrl+R Ctrl+X («execute command», GTFOBins) → root reverse shell → root.txt

1. Reconnaissance

We start with the basics: which ports are open and what software is listening on each. That decides where we go next.

nmap -A 10.129.23.183

22/tcp  open  ssh      OpenSSH
80/tcp  open  http     Apache httpd 2.4.29 (Ubuntu)

Only two ports: SSH and an Apache server showing Ubuntu's default page, nothing interesting at first glance. With SSH not a reasonable brute-force target, port 80 is the vector.

Resumen ejecutivo — OpenAdmin es un Linux Easy con una cadena larga y muy educativa de reutilización de credenciales: una RCE sin autenticación en OpenNetAdmin 18.1.1 (CVE-2019-3980); credenciales de BD en claro que se reutilizan para SSH (jimmy); una app web interna, solo accesible en localhost, que filtra la clave SSH de joanna (cuya passphrase se craquea con John); y una escalada final vía sudo nano (GTFOBins). Recorrido ONA RCE → jimmy → joanna → sudo nano → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.23.183`

Mapa del ataque

[80/HTTP] Apache 2.4.29 → dirsearch → /music → /ona/  = OpenNetAdmin 18.1.1
   │  CVE-2019-3980 (EDB-47691) — command injection vía xajax, sin auth → www-data
   ▼
[FILE] database_settings.inc.php → ona_sys:n1nj4W4rri0R! (en claro, reutilizada)
   ▼
[SSH]  jimmy
   │  grupo internal → /var/www/internal (main.php) sirviendo en localhost:52846
   │  main.php filtra el id_rsa de joanna (shell_exec)
   ▼
[SSH]  joanna  (passphrase «bloodninjas» crackeada con John/rockyou)  → user.txt
   │  sudo -l → (ALL) NOPASSWD: /bin/nano /opt/priv
   ▼
[ROOT]  nano → Ctrl+R Ctrl+X («execute command», GTFOBins) → reverse shell de root → root.txt

1. Reconocimiento

Empezamos por lo básico: qué puertos están abiertos y qué versión de software corre en cada uno. Eso decide por dónde seguimos.

nmap -A 10.129.23.183

22/tcp  open  ssh      OpenSSH
80/tcp  open  http     Apache httpd 2.4.29 (Ubuntu)

Solo dos puertos: SSH y un Apache con la página por defecto de Ubuntu, sin nada interesante a simple vista. Con SSH cerrado a fuerza bruta razonable, el vector es el 80.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.