# Connected Writeup - HackTheBox

> Exploit MongoDB misconfiguration with unauthenticated access to enumerate databases and retrieve credentials, ultimately gaining root on an easy Linux box.

- **URL:** https://hackindex.io/writeups/connected
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** sql-injection, nosql-injection, webshell, mongodb, privilege-escalation, cron-abuse, base64, cve-2025-57819
- **Access:** Partly password protected
- **Authors:** [Benslates](https://hackindex.io/authors/benslates.md), [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 5 min read
- **Published:** 2026-05-30
- **Updated:** 2026-06-10

## **Reconnaissance - Nmap Scan**

An initial Nmap scan was performed to identify open ports on the target machine.

### **Open Port Scan**

```bash
nmap -T5 --open $TARGET_IP
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-07 07:19 +0500
# Nmap scan report for 10.129.5.142
# Host is up (0.24s latency).
# Not shown: 997 filtered tcp ports (no-response)
# Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
# PORT    STATE SERVICE
# 22/tcp  open  ssh
# 80/tcp  open  http
# 443/tcp open  https
#
# Nmap done: 1 IP address (1 host up) scanned in 23.05 seconds
```

### **Service Version and Script Scan**

Further Nmap scans were conducted to determine service versions and run default scripts on the identified open ports (80 and 443).

```bash
nmap -sV -sC -p 80,443 $TARGET_IP
# Starting Nmap 7.99 ( https://nmap.org ) at 2026-06-07 07:20 +0500
# Nmap scan report for 10.129.5.142
# Host is up (0.32s latency).
#
# PORT    STATE SERVICE  VERSION
# 80/tcp  open  http     Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/7.4.16)
# |_http-title: Did not follow redirect to http://connected.htb/
# |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.16
# 443/tcp open  ssl/http Apache httpd 2.4.6 ((CentOS) OpenSSL/1.0.2k-fips PHP/7.4.16)
# |_http-server-header: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.16
# | ssl-cert: Subject: commonName=pbxconnect/organizationName=SomeOrganization/stateOrProvinceName=SomeState/countryName=--
# | Not valid before: 2025-11-30T14:07:27
# |_Not valid after:  2026-11-30T14:07:27
# |_ssl-date: TLS randomness does not represent time
# |_http-title: 400 Bad Request
#
# Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done: 1 IP address (1 host up) scanned in 36.93 seconds
#
```

## **Hostname Resolution**

The Nmap scan indicated a redirect to `connected.htb`. To resolve this, an entry was added to the `/etc/hosts` file.

```bash
echo "$TARGET_IP connected.htb" | sudo tee -a /etc/hosts
# 10.129.5.142 connected.heb
#
```

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.