Enigma exposes more network services than a typical Easy-rated machine, but the route through them is logical once the information from each service is connected. The public website does not provide the initial foothold. Instead, the machine begins with an exposed NFS share containing an employee-onboarding document.
That document discloses credentials for the corporate Roundcube webmail instance. The first mailbox provides a username pattern and demonstrates that employees are using a predictable password. Reusing the same password against another employee account reveals credentials for an internal support portal.
The support portal runs OpenSTAManager 2.9.8. This version is vulnerable to an authenticated arbitrary-SQL issue in the Aggiornamenti module and to insecure PHP deserialization in the OAuth2 flow. The custom exploit included in this writeup combines those two weaknesses, uses PHPGGC to build a gadget chain, inserts it into the database, and triggers it through the unauthenticated OAuth2 endpoint.
The initial command execution runs as www-data. OpenSTAManager's configuration then exposes database credentials, and the application database contains a bcrypt hash for the local user haris. Cracking that hash produces a reusable system password and a proper user shell.
Privilege escalation is performed through OliveTin, which is listening only on localhost. One of its actions builds a mysqldump command by inserting API-controlled values directly into a shell string. Breaking out of the single-quoted database password allows commands to be executed by the root-owned OliveTin process.
Full TCP enumeration
Start with a full TCP scan rather than checking only common ports. NFS depends on RPC services and dynamically assigned mountd ports, so the complete result provides useful context even though the main NFS service is on port 2049.
The -sC option runs Nmap's default scripts, -sV performs service-version detection, -Pn skips host discovery, and -n prevents reverse-DNS lookups.
Nmap scan report for enigma.htb (10.129.30.133)
Host is up, received user-set (0.051s latency).
Not shown: 65522 closed tcp ports (reset)
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 0c:4b:d2:76:ab:10:06:92:05:dc:f7:55:94:7f:18:df (ECDSA)
|_ 256 2d:6d:4a:4c:ee:2e:11:b6:c8:90:e6:83:e9:df:38:b0 (ED25519)
80/tcp open http syn-ack ttl 63 nginx 1.24.0 (Ubuntu)
| http-methods:
|_ Supported Methods: GET HEAD
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Enigma Corp — Managed IT Solutions
110/tcp open pop3 syn-ack ttl 63 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
|_pop3-capabilities: UIDL CAPA SASL TOP STLS AUTH-RESP-CODE PIPELINING RESP-CODES
| ssl-cert: Subject: commonName=enigma
| Subject Alternative Name: DNS:enigma
| Issuer: commonName=enigma
| Public Key type: rsa
| Public Key bits: 2048
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-02-18T20:33:33
| Not valid after: 2036-02-16T20:33:33
111/tcp open rpcbind syn-ack ttl 63 2-4 (RPC #100000)
| rpcinfo:
| program version port/proto service
| 100003 3,4 2049/tcp nfs
| 100003 3,4 2049/tcp6 nfs
| 100005 1,2,3 33282/udp6 mountd
| 100005 1,2,3 41894/udp mountd
| 100005 1,2,3 43325/tcp mountd
| 100005 1,2,3 60451/tcp6 mountd
| 100021 1,3,4 33007/tcp6 nlockmgr
| 100021 1,3,4 34825/udp nlockmgr
| 100021 1,3,4 40013/tcp nlockmgr
|_ 100021 1,3,4 56733/udp6 nlockmgr
143/tcp open imap syn-ack ttl 63 Dovecot imapd (Ubuntu)
|_imap-capabilities: STARTTLS capabilities Pre-login more IMAP4rev1 SASL-IR have LOGIN-REFERRALS LITERAL+ ID post-login LOGINDISABLEDA0001 IDLE ENABLE listed OK
993/tcp open ssl/imap syn-ack ttl 63 Dovecot imapd (Ubuntu)
|_imap-capabilities: have capabilities Pre-login IMAP4rev1 SASL-IR more LOGIN-REFERRALS LITERAL+ ID post-login listed IDLE ENABLE AUTH=PLAINA0001 OK
995/tcp open ssl/pop3 syn-ack ttl 63 Dovecot pop3d
|_pop3-capabilities: UIDL CAPA SASL(PLAIN) TOP USER AUTH-RESP-CODE PIPELINING RESP-CODES
2049/tcp open nfs syn-ack ttl 63 3-4 (RPC #100003)
38779/tcp open status syn-ack ttl 63 1 (RPC #100024)
40013/tcp open nlockmgr syn-ack ttl 63 1-4 (RPC #100021)
43325/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
44873/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
50273/tcp open mountd syn-ack ttl 63 1-3 (RPC #100005)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Three areas deserve immediate attention. They are common but quite useful.
Of course port 80 is handled by Nginx. Nginx frequently hosts several applications behind name-based virtual hosts, so the page returned for enigma.htb may not be the only web application on the server.
Next the POP3 and IMAP services show that this is also a mail server. Any usernames or passwords found later should therefore be tested against both the mail protocols and possible webmail frontends.
Finally, rpcbind explicitly advertises NFS versions 3 and 4. An exposed NFS export can reveal documents, backups, configuration files, or credentials without requiring a traditional software exploit.
Add the target hostname to /etc/hosts before continuing.
echo '10.129.30.133 enigma.htb' | sudo tee -a /etc/hosts # this one is release arena IP not the machine one
This is a preview of an article or content section that is not ready to be disclosed.
It starts with limited visibility...
Enigma is an Easy Linux machine that rewards careful service correlation rather than rushing toward the first web page.
Pay close attention to exposed file shares, employee documentation, and the way credentials move between internal services. Virtual-host enumeration is essential, especially when several applications are hidden behind the same web server.
Once you obtain a foothold, inspect application configuration, internal services users and not-default installed files as always.