> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-delivery.md).
# HTB - Delivery
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open http nginx 1.14.2
8065/tcp open http Golang net/http server
```
### HTTP - 80
clicking on the contact us lead to the below page.
Now the page highlights, that all unregistered users can get in touch with helpdesk and registered users with @delivery.htb email can be able to access matter most server.
Now clicking on help desk leads to new host `helpdesk.delivery.htb` and clicking on matter most lead to port 8065
### HTTP - 8065
we can create an account as we do not have any account yet.
now back on help desk.
## Helpdesk.delivery.htb
i can create a new ticket.
viewing the status of the ticket allows us to edit the ticket.
creating an account and signing needs account confirmation.
### mattermost instance
there is a registration link on port 8065 to.
creating acocunt also leads to confirmation.
i have created a account as `ajay@ajay.com` but the contact form mentioned users with @delivery.htb have access to matter most.
lets try creating user in that way using the mail `5919608@delivery.htb`
when created asked to send confirmation mail.
but back on the ticketing system received a registration successful link.
once verified i got access to the instance.
we can join to the internal channel.
the internal channel leaked credentials for maildeliverer.
`maildeliverer:Youve_G0t_Mail!`
## Shell as maildeliverer
I can use the creds to get a shell using SSH
checking the config page at `/opt/mattermost/config/config.json`
reveals the password for mysql instance running locally. we can connect to it using the creds through the shell.
### Mysql Access
The tables showed there is a table name called Users;
i need only the username and password.
Got the hash for root.
We can crack the hash but the mattermost channel hgave a indirect hint on how to crack the hash.
They talk about variants of `PleaseSubscribe!`
#### Creating variants using hashcat rules
```bash
┌──(ajay㉿kali)-[~]
└─$ echo 'PleaseSubscribe!' > base.txt
hashcat --stdout -r /usr/share/hashcat/rules/best66.rule base.txt
PleaseSubscribe!
!ebircsbuSesaelP
PLEASESUBSCRIBE!
pleaseSubscribe!
PleaseSubscribe!0
PleaseSubscribe!1
PleaseSubscribe!2
PleaseSubscribe!3
PleaseSubscribe!4
PleaseSubscribe!5
PleaseSubscribe!6
```
Copy the variants to file called `passwords.txt` and crack the hash using john or hashcat.
`root : PleaseSubscribe!21`
## Shell as Root
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/ippsec-unofficial-cpts-prep/htb-delivery.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `build a script that syncs our docs to a CMS` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
