pentestPromedium

Bedside

hackthebox

Task: an HTB Linux machine with a hidden research vhost, a PDF upload pipeline, and an internal trainer service. Solution: exploit pdfminer.six deserialization for container RCE, use internal path traversal to recover a developer SSH key, then abuse unsafe MONAI checkpoint loading through sudo for root.

hackthebox linux virtual_host file_upload pdfminer_six insecure_deserialization pickle docker path_traversal ssh monai pytorch sudo

vhost_enumerationupload_validation_probingpdf_parser_deserializationinternal_path_traversalssh_with_recovered_keyshared_volume_abusemonai_checkpoint_deserializationsudo_abuse

$ ls tags/ techniques/

hackthebox linux virtual_host file_upload pdfminer_six insecure_deserialization pickle docker path_traversal ssh monai pytorch sudo

vhost_enumerationupload_validation_probingpdf_parser_deserializationinternal_path_traversalssh_with_recovered_keyshared_volume_abusemonai_checkpoint_deserializationsudo_abuse

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups