infraPromedium

Kobold

hackthebox

Task: HackTheBox machine with MCP Inspector, PrivateBin, and Arcane Docker Management. Solution: SSRF/RCE via MCP protocol, PHP injection into PrivateBin data files to leak config, password reuse to Arcane API, Docker container mount for root flag.

$ ls tags/ techniques/
ssrfdockerjwtlinuxnginxpassword_reuseubuntuvhost_enumerationhacktheboxfull_pwncontainer_escapemcp_protocolmcp_inspectorprivatebinphp_code_injectionconfig_leakarcanedocker_compose
vhost_fuzzing_subdomain_discoveryssrf_via_mcp_connect_endpointrce_via_mcp_stdio_transportphp_injection_into_privatebin_data_filesconfig_leak_via_shared_docker_volumepassword_reuse_across_servicesdocker_container_host_mount_escalationarcane_api_abuse_for_container_creation
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups