Hackthebox: Kobold
kobold , an easy-rated hackthebox machine dealing with a remote-code execution on an mcp platform with a known cve that can trigger a reverse shell with python script , then escalating the privilege by changing id of primary group with another one and running a docker instance for the root flag
first we do nmap scan as usual
we’ve noticed that it will always redirect to https always so let’s check the website
nothing really useful but looking back at the nmap scan i noticed that Port 443 — HTTPS (nginx 1.24.0) serving a web app called “Kobold Operations Suite.” The TLS cert covers both kobold.htb and *.kobold.htb — the wildcard subdomain is a significant clue.
so i did some vhost enumeration using both ffuf and gobuster
i found mcp.kobold.htb and bin.kobold.htb and going to these two sites i found a platform for hosting our own mcp server and another one for privatebin
looking at these two , starting first with the mcp one i tried to search for version and i found in settings the version
and of course i googled it , i found a cve
Get Dhiasaid’s stories in your inbox
Join Medium for free to get updates from this writer.
with this cve i was able to get remote code execution due to http endpoint access
and launching nc server with 1234 i got the shell
and i grabbed the user flag from it
now for the privilege escalation part , it really sucks , i did a lot of enumeration process , went to bin file , found a cve related to private bin , and nothing really useful , but what i noticed is that i found user alice belongs to group docker and ben to his own group , there is a really known command in linux that can changes id of primary group , so when i typed newgrp docker (sometimes it requires a password ) it worked and i changed it
and now i did docker image i found these two
a container that hosts private bin and a container that hosts mysql as root
so i executed mysql with root
it worked and i redirected the root flag in flag.txt in tmp directory and i pwned the machine
good machine to pwn , thought it was not really easy , but it was a piece of cake , till the next one
