> For the complete documentation index, see [llms.txt](https://4lec4st.gitbook.io/4lec4st/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://4lec4st.gitbook.io/4lec4st/writes-ups/hack-the-box/easy/soulmate.md).

# Soulmate

## Información de la máquina

<figure><img src="/files/hCkm0umz5JpNJwrHP5A1" alt=""><figcaption></figcaption></figure>

`Soulmate` es una máquina Linux de dificultad fácil que muestra la explotación de [CVE-2025-31161](https://nvd.nist.gov/vuln/detail/CVE-2025-31161) , una vulnerabilidad de omisión de autenticación en CrushFTP, que permite acceder a una cuenta de usuario administrador. Al subir un archivo PHP malicioso a la raíz web de la aplicación, se logra la ejecución remota de comandos. Para la escalada de privilegios, [CVE-2025-32433](https://nvd.nist.gov/vuln/detail/CVE-2025-32433) , otra vulnerabilidad de ejecución remota de comandos en el servidor SSH Erlang/OTP, se está explotando para obtener acceso `root`.

## Reconocimiento

<figure><img src="/files/QljLEMwikm0hjamaXis5" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/65cGbwy3rDW0PiqjYwUV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/xEACB75vWFkLuXHQ859V" alt=""><figcaption></figcaption></figure>

## Enumeración de la página web

<figure><img src="/files/zASoUs3irgAtvotxoRNC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/lhF35UanuTCmJr0Adi8j" alt=""><figcaption></figcaption></figure>

### Descubrimiento de subdirectorios

<figure><img src="/files/dMY45yooyt8ESrVRcyTQ" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/oq3QecNJ02FEiu0LvHPI" alt=""><figcaption></figcaption></figure>

### Descubrimiento de subdominios

<figure><img src="/files/uEAJjaEA62owKyB2I87G" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/nOtgUyAH8tFpyVwPekB8" alt=""><figcaption></figcaption></figure>

## CrushFTP&#x20;

<figure><img src="/files/xn5rkUl7uaNT0QC1NA9v" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/uSXyBrZ2t3VLXJObYz4n" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/0RHZEvSPeIkZ1VppXo7D" alt=""><figcaption></figcaption></figure>

### CVE-2025-31161 - Authentication Bypass CrushFTP

<figure><img src="/files/02QcA1CHU9T8AKDsmqGd" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.huntress.com/blog/crushftp-cve-2025-31161-auth-bypass-and-post-exploitation>" %}

<figure><img src="/files/CoHqQTw0P9WXVjPot6WY" alt=""><figcaption></figcaption></figure>

### Exploiting CrushFTP

<figure><img src="/files/kvLydDGPzxEWW8mCyxoq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/gm1pZLWanOWWVwWUcboM" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/je4GiPAy5vPcQmLYBJRN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/2jNtHOFQkIdnxrnZw3c3" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Jvqt4WsrSY05tZoDMeev" alt=""><figcaption></figcaption></figure>

## File Upload PHP archive -> RCE

<figure><img src="/files/5yV5sJKyE4v4CKPRtdYo" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/1ohr9qpnbNbBPqZ8Msjf" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5WD6bAYwETAKQrm8dOX7" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/aLqWY3qwjZOyWnvRMCnX" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/rX2zR292Ooyocb37Ex6H" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/B400eFrCm3su7tTp8XHH" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/caw6RFyz8y6EDeDsulCE" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8a06Z4wxculEZZldjzgy" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/IiuYlCOJoSsEzGG9T3pZ" alt=""><figcaption></figcaption></figure>

## Shell www-data

### Enumeración del sistema

<figure><img src="/files/t1KVb4ntXyZ6BS7Df7i1" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/jgSTJRKvN0DTCpjIqqga" alt=""><figcaption></figcaption></figure>

### Enumeración DB -> admin credentials (rabbit hole)

<figure><img src="/files/XfTNVDpg8NoH18nfeYQq" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/xMECB1zInsqHc7W42K6E" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/WHRo5IF6M6cBqvg1YoNT" alt=""><figcaption></figcaption></figure>

## Crendential ben in erlang\_login

<figure><img src="/files/5Aj6Mz99A6vsuxEJrSAV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/mHKCHu4i3rtCjIzHIsn9" alt=""><figcaption></figcaption></figure>

## Shell ben

<figure><img src="/files/ZnCtcyneND97A4tPv0R4" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Z5rnQg2SrRb4YOhROiKL" alt=""><figcaption></figcaption></figure>

### SSH local port 2222 erlang shell

<figure><img src="/files/jw8NKud5B41FuDrlcNdd" alt=""><figcaption></figcaption></figure>

### Command Execution Eshell terminal

<figure><img src="/files/TC5ncCTXwvdhidIGdqtU" alt=""><figcaption></figcaption></figure>

{% embed url="<https://www.tutorialspoint.com/erlang/erlang_shell.htm>" %}

<figure><img src="/files/rOaSmAr1mnG3DLnvbz5z" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3YxgL9jqBfMWJjB6X4HN" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/RjDlat7SAhXL6BNRTLKw" alt=""><figcaption></figcaption></figure>

## Root access

<figure><img src="/files/vrisg9lgiHihb344Agp1" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/6X9gy7fMlVL8zuOkRDAw" alt=""><figcaption></figcaption></figure>