Hack The Box: Code – Season 7 (Rewritten Summary)

Hack The Box: Code – Season 7 (Rewritten Summary) **Phase 1 – Initial Reconnaissance** The engagement began with a comprehensive network scan using Nmap to identify accessible services on the target host (10.10.11.62). The scan revealed two significant open ports: SSH (22) and HTTP (5000). The HTTP service hosted a Python-based Code Editor running via Gunicorn, indicating a possible attack vector for remote code execution. **Phase 2 – Code Editor Exploitation** The Python Code Editor was found to allow arbitrary script execution. By injecting a Python command to enumerate database users, the following credentials were retrieved (hashed form): development and martin. These hashes were successfully cracked to reveal plaintext passwords: ‘development:development’ and ‘martin:nafeelswordsmaster’. Using Martin’s credentials, SSH access was obtained, granting user-level entry. **Phase 3 – Privilege Escalation via Backup Script** While exploring Martin’s environment, a backup script named ‘backy.sh’ was discovered in /usr/bin/. This script, executed with elevated privileges via sudo, accepted a JSON configuration file (task.json) to define backup operations. It was restricted to certain directories, but manipulation of the input file enabled access to sensitive files beyond its intended scope. **Step 1: Extracting User Flag** By modifying task.json to target the /home/app-production/user.txt file, the script was executed and successfully backed up the file. Extracting the archive revealed the first flag, confirming partial system compromise. **Step 2: Extracting Root Flag** Using a path traversal technique in the task.json configuration (e.g., '/var/....//root/'), the script was again executed, retrieving the root.txt file. This granted access to the system’s highest privilege level, marking full compromise. **Phase 4 – Key Insights and Lessons** This study source was downloaded by 100000902974540 from CourseHero.com on 03-02-2026 19:12:35 GMT -06:00 https://www.coursehero.com/file/252616809/Code-S7-Rewrittenpdf/ This penetration test demonstrated several critical security issues: exposure of unnecessary services, improper access control in scripts with elevated privileges, and weak password management practices. By securing sudo scripts, enforcing strong authentication, and limiting accessible directories, such exploits can be mitigated.