Traverxec — HTB Writeup | The Hack Sparrow

Executive summary — Traverxec is an Easy Linux box with three clean steps: an unauthenticated RCE in Nostromo 1.9.6 (CVE-2019-16278); a backup of david's SSH key hidden on the server (with an encrypted passphrase cracked offline); and a textbook escalation via sudo journalctl that — run without the | cat the legitimate script uses — opens the less pager, from which you spawn a root shell. A Nostromo RCE → david's SSH backup → sudo journalctl → root path.

Platform	Hack The Box
Operating system	Linux
Difficulty	Easy
Status	Retired
Target IP	`10.129.1.246`

Attack map

[80] nostromo 1.9.6
   │  CVE-2019-16278 — path traversal → RCE (unauth)
   ▼
[www-data]
   │  david's SSH key backup in protected-file-area
   ▼
[SSH]  david  (encrypted id_rsa → passphrase via john: "hunter")  → user.txt
   │  sudo journalctl -u nostromo.service (no pipe to cat → opens less)
   ▼
[ROOT]  from less: !/bin/sh

1. Reconnaissance

nmap -sC -sV -p- 10.129.1.246

22/tcp  open  ssh
80/tcp  open  http  nostromo 1.9.6

The clue: the web server is Nostromo 1.9.6, an uncommon server with a known public RCE — not a generic Apache/Nginx.

Resumen ejecutivo — Traverxec es un Linux Easy con tres pasos muy limpios: una RCE sin autenticación en Nostromo 1.9.6 (CVE-2019-16278); un backup de la clave SSH de david escondido en el servidor (con passphrase cifrada que se craquea offline); y una escalada de libro por sudo journalctl, que — si se ejecuta sin el | cat que usa el script legítimo — abre el pager less, desde el que se lanza una shell de root. Recorrido Nostromo RCE → backup SSH de david → sudo journalctl → root.

Plataforma	Hack The Box
Sistema operativo	Linux
Dificultad	Easy
Estado	Retired
IP objetivo	`10.129.1.246`

Mapa del ataque

[80] nostromo 1.9.6
   │  CVE-2019-16278 — path traversal → RCE (sin auth)
   ▼
[www-data]
   │  backup de claves SSH de david en protected-file-area
   ▼
[SSH]  david  (id_rsa cifrada → passphrase con john: "hunter")  → user.txt
   │  sudo journalctl -u nostromo.service (sin el pipe a cat → abre less)
   ▼
[ROOT]  desde less: !/bin/sh

1. Reconocimiento

nmap -sC -sV -p- 10.129.1.246

22/tcp  open  ssh
80/tcp  open  http  nostromo 1.9.6

La pista: el servidor web es Nostromo 1.9.6, un servidor poco común y con una RCE pública conocida (no un Apache/Nginx genérico).

🔒 Clearance required

This content is Root Access only. Everything else on the site — the free tier, the whole public library — stays open.

See Root Access plans

No account? Create one free then upgrade from your console.