Photobomb — HTB Writeup | The Hack Sparrow

Executive summary — Photobomb is a very instructive Easy Linux box: an exposed JavaScript file (photobomb.js) leaks the Basic Auth credentials (pH0t0:b0Mb!) that unlock the printing panel /printer. That panel builds a system command from the filetype parameter without sanitising it, allowing command injection and a shell as wizard. Escalation abuses sudo with SETENV over a cleanup script that calls find without an absolute path: a textbook PATH hijack turns it into root. Path: creds in JS → command injection → PATH hijack → root.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.228.60`

Attack map

[80] photobomb.htb (vhost) → photobomb.js leaks creds  pH0t0:b0Mb!
   │  Basic-Auth → /printer panel
   ▼
[RCE]  command injection in the filetype parameter (POST /printer)
   ▼
[SHELL]  wizard  (user.txt)
   │  sudo -l → (root) SETENV NOPASSWD /opt/cleanup.sh (calls find without an absolute path)
   ▼
[ROOT]  PATH hijacking (SETENV) → fake find → chmod 4755 /bin/bash → bash -p

1. Initial reconnaissance

nmap -sC -sV -oN nmap/targeted 10.129.228.60

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu
80/tcp open  http    nginx 1.18.0 (Ubuntu)

Only two services exposed: SSH and HTTP. The web server responds pointing to a virtual host, photobomb.htb, that doesn't resolve yet in our /etc/hosts — the obvious entry point is port 80.

Resumen ejecutivo — Photobomb es un Linux Easy muy didactico: un archivo JavaScript expuesto (photobomb.js) filtra las credenciales de Basic Auth (pH0t0:b0Mb!) que dan acceso al panel de impresion /printer. Ese panel construye una orden de sistema con el parametro filetype sin sanear, lo que permite command injection y una shell como wizard. La escalada aprovecha sudo con SETENV sobre un script de limpieza que invoca find sin ruta absoluta: un PATH hijacking clasico lo convierte en root. Recorrido creds en JS → command injection → PATH hijack → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.228.60`

Mapa del ataque

[80] photobomb.htb (vhost) → photobomb.js filtra creds  pH0t0:b0Mb!
   │  Basic-Auth → panel /printer
   ▼
[RCE]  command injection en el parametro filetype (POST /printer)
   ▼
[SHELL]  wizard  (user.txt)
   │  sudo -l → (root) SETENV NOPASSWD /opt/cleanup.sh (llama a find sin ruta absoluta)
   ▼
[ROOT]  PATH hijacking (SETENV) → find falso → chmod 4755 /bin/bash → bash -p

1. Reconocimiento inicial

nmap -sC -sV -oN nmap/targeted 10.129.228.60

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu
80/tcp open  http    nginx 1.18.0 (Ubuntu)

Solo dos servicios expuestos: SSH y HTTP. El servidor web responde apuntando a un nombre de host virtual, photobomb.htb, que aun no resuelve en nuestro /etc/hosts — el punto de entrada evidente es el 80.

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.