HTB - Delivery
TL;DR - A support site runs osTicket and a Mattermost chat server. Creating a ticket hands us a temporary @delivery.htb email, which we use to register and self-validate a Mattermost account, because the validation link lands back in our own ticket. Inside Mattermost, a team channel leaks SSH credentials (maildeliverer) for the foothold. Root comes from the Mattermost DB config, which holds MySQL creds, where the root user’s hash lives, cracked with a hashcat ruleset applied to a password hint found in the same chat. ...