Connected
asterisk user.
Root came from an incron / sysadmin hook chain: a writable local trigger directory caused
sysadmin_manager to execute a signed FreePBX firewall hook as root.
01Why the full writeup is held back
Connected is a live Season 11 machine, so — in line with Hack The Box's guidance on active machines — I'm not publishing a step-by-step reproduction. The complete writeup (recon, the FreePBX CVE foothold, and the hook-chain privilege escalation, with commands and remediation) goes live here once the season closes.
02The interesting bits (no spoilers)
A fresh CVE in the wild — FreePBX CVE-2025-57819
Rather than a dated exploit, the foothold used a recently-disclosed FreePBX vulnerability to plant a webshell and land a reverse shell as the telephony service account. A reminder that internet-facing PBX / VoIP appliances are a real attack surface and need the same patch discipline as everything else.
Root through a signed-hook trust chain
Privilege escalation abused an incron-watched trigger directory that a root helper
(sysadmin_manager) acted on — it executed a signed FreePBX firewall hook as root. When a
privileged process trusts and runs content from a location a lower-privileged user can write to, the signing
doesn't save you.
03Takeaways
- Patch appliances, not just servers — FreePBX/Asterisk are exposed services; CVE-2025-57819 is a live example.
- Watch trigger directories — incron/cron/hook mechanisms that act on user-writable paths are a classic privesc primitive.
- A signature isn't authorization — a root process trusting a writable input location breaks the whole chain.
- Straight into the day job: monitor for suspicious hook execution, and audit who can write to anything a privileged service consumes.