Soulmate — HTB Writeup | The Hack Sparrow

Executive summary — Soulmate is an Easy Linux box with two surfaces: a PHP dating site (no viable RCE path) and a CrushFTP instance on a subdomain, vulnerable to CVE-2025-31161 (authentication bypass). After creating an admin user, a real disk folder has to be mapped into the user's VFS — a step so poorly documented it had to be automated by capturing the admin UI's real traffic with Selenium + mitmproxy. From there, a webshell gives www-data, and an Erlang script with a hardcoded password (reused by the real ben account) leads to a mini Erlang-based SSH server that, running as root with no privilege drop at all, hands out an Erlang REPL equivalent to root command execution.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.231.23`

Attack map

[80] soulmate.htb — PHP dating site (photo upload has no viable bypass)
   │  epmd reveals an Erlang ssh_runner node + the ftp.soulmate.htb subdomain (CrushFTP)
   ▼
[CrushFTP] CVE-2025-31161 — auth bypass → admin account created
   │  VFS mapped to /app/webProd (real disk) via Selenium + mitmproxy
   ▼
[RCE]  Webshell uploaded → www-data
   │  Hardcoded ben:HouseH0ldings998 credential in an Erlang script running as root
   ▼
[SSH]  ben@host  (ForceCommand → interactive shell via paramiko)
   │  same password reused on the local Erlang-based SSH (127.0.0.1:2222)
   ▼
[ROOT]  Erlang Eshell with no privilege drop → os:cmd() as root

1. Reconnaissance

nmap -p- --min-rate 5000 -v 10.129.231.23 -oN nmap_ports.txt

PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http
4369/tcp  open     epmd

nmap -p22,80,4369 -sCV -v 10.129.231.23 -oN nmap_sV.txt

22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soulmate.htb/
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|   nodes:
|_    ssh_runner: 40979

The epmd-info reveals a registered Erlang node called ssh_runner. Connecting directly to its reported distribution port is refused from outside (Connection refused) — that node's real listener is on 127.0.0.1, and only becomes relevant once there's local code execution on the box.

Resumen ejecutivo — Soulmate es una Easy Linux con dos superficies: un sitio de citas en PHP (sin vía de RCE viable) y una instancia de CrushFTP en un subdominio, vulnerable a CVE-2025-31161 (bypass de autenticación). Tras crear un usuario administrador, hace falta mapear una carpeta real del disco al VFS del usuario — un paso tan poco documentado que se automatizó capturando el tráfico real de la UI de administración con Selenium + mitmproxy. Desde ahí, un webshell da www-data, y un script Erlang con una contraseña hardcodeada (reutilizada por la cuenta real ben) lleva a un mini servidor SSH-en-Erlang que, corriendo como root sin ningún drop de privilegios, entrega una REPL de Erlang equivalente a ejecución de comandos como root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.231.23`

Mapa del ataque

[80] soulmate.htb — sitio de citas PHP (subida de foto sin bypass viable)
   │  epmd revela un nodo Erlang ssh_runner + subdominio ftp.soulmate.htb (CrushFTP)
   ▼
[CrushFTP] CVE-2025-31161 — bypass de autenticación → usuario admin creado
   │  VFS mapeado a /app/webProd (disco real) vía Selenium + mitmproxy
   ▼
[RCE]  Webshell subido → www-data
   │  Credencial hardcodeada ben:HouseH0ldings998 en un script Erlang que corre como root
   ▼
[SSH]  ben@host  (ForceCommand → shell interactiva vía paramiko)
   │  misma contraseña reutilizada en el SSH-en-Erlang local (127.0.0.1:2222)
   ▼
[ROOT]  Eshell de Erlang sin drop de privilegios → os:cmd() como root

1. Reconocimiento

nmap -p- --min-rate 5000 -v 10.129.231.23 -oN nmap_ports.txt

PORT      STATE    SERVICE
22/tcp    open     ssh
80/tcp    open     http
4369/tcp  open     epmd

nmap -p22,80,4369 -sCV -v 10.129.231.23 -oN nmap_sV.txt

22/tcp   open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://soulmate.htb/
4369/tcp open  epmd    Erlang Port Mapper Daemon
| epmd-info:
|   epmd_port: 4369
|   nodes:
|_    ssh_runner: 40979

El epmd-info revela un nodo Erlang registrado llamado ssh_runner. Conectar directamente a su puerto de distribución reportado se rechaza desde fuera (Connection refused) — el listener real de ese nodo está en 127.0.0.1, y solo será relevante una vez haya ejecución local en la máquina.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.