root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to HackTheBox writeups
root@sparrow:~/writeups$ cat nocturnal.md
// writeups

Nocturnal

12 Apr 2025 · 12 min read · root access
writeupshacktheboxlinuxEasyretiredvip
Nocturnal - maquina de Hack The Box

Executive summary — Nocturnal is an Easy Linux box with a long, very realistic chain, a great example of how a "minor" web bug ends in full compromise. An IDOR in view.php lets us enumerate users and read other accounts' files with zero authorisation checks; from one of amanda's .odt documents we extract her password and reach the admin panel. There, an incomplete character filter in the backup function —it blocks ; & | $ and the space, but not the newline (%0a) or the tab (%09)— lets us inject commands and get a shell as www-data. A local SQLite database exposes tobias' MD5 hash; after cracking it we find he reuses the same password on ISPConfig, a panel that only listens on 127.0.0.1:8080. With those credentials we exploit CVE-2023-46818 (PHP code injection in the language editor) to get a root shell. Path: IDOR → leaked credentials → command injection → SQLite → password reuse → CVE-2023-46818 → root.

PlatformHack The Box
Operating systemLinux
DifficultyEasy
StatusRetired
Target IP10.10.11.64

Attack map

[80] nocturnal.htb → register + upload a file → view.php?username=&file= pattern
   │  IDOR in view.php → enumerate users and read others' files
   ▼
[amanda]  leaked privacy.odt → her password → admin.php panel
   ▼
[SHELL]  backup with an incomplete filter (misses %0a/%09) → command injection → www-data
   │  local SQLite → tobias' MD5 hash → cracked → su tobias  (user.txt)
   ▼
[pivot]  tobias' password reused → SSH tunnel → ISPConfig on 127.0.0.1:8080
   ▼
[ROOT]  CVE-2023-46818 (ISPConfig code injection)  (root.txt)

1. Reconnaissance

Before touching anything we enumerate services, and as soon as we see the site redirects to a domain, we resolve it locally so we see exactly what the server sees.

nmap -p- --min-rate 10000 10.10.11.64
22/tcp open  ssh
80/tcp open  http
nmap -p22,80 -sCV 10.10.11.64

Relevant results: OpenSSH 8.2p1, nginx 1.18.0, and a redirect to http://nocturnal.htb/. We add the host and check it loads:

echo "10.10.11.64 nocturnal.htb" | sudo tee -a /etc/hosts
curl -I http://nocturnal.htb

The site is a PHP-based file storage/sharing app. A feroxbuster run confirms some interesting paths:

feroxbuster -u http://nocturnal.htb -x php
/admin.php
/dashboard.php
/view.php
/backups/
/uploads*   (blocked)
🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.