Cosm3No1de

Classification basis

The artifact is a writeup. It provides a substantive technical analysis of a penetration testing engagement, including reconnaissance, exploitation, and privilege escalation steps. It does not contain functional exploit or scanner code; the provided code snippets are illustrative and redacted. The README.md explicitly states it is a 'complete penetration testing walkthrough' and the index.html is a styled presentation of the same content.

Requirements

• Access to the target MLflow instance with default credentials (admin:password).README.md:101-106
• Ability to upload a malicious pickle payload to the MLflow model registry.README.md:111-121
• Write access to the /opt/tools/mlflow_ctl/plugins/dev/ directory for privilege escalation.README.md:198-201

Observed behavior

• Describes using default credentials to authenticate to an MLflow instance.README.md:101-106
• Describes creating a malicious pickle payload with a __reduce__ method to execute a reverse shell command.README.md:126-131
• Describes triggering the deserialization by sending a POST request to the /predict endpoint.README.md:140-143
• Describes using a bind shell to bypass an egress firewall.README.md:159-162
• Describes privilege escalation by creating a malicious .pth file and a fake mlflow_actions.py module to execute commands as root via sudo.README.md:218-235

Observables

Exploit Payload

Payload withheldA reverse shell payload used to gain initial access as part of the documented CVE-2024-37054 exploitation.README.md:130

Exploit Payload

Payload withheldA bind shell payload used to bypass an egress firewall, consistent with the described privilege escalation path.README.md:162

Privilege Escalation Command

Payload withheldA command used in the malicious Python module to set the SUID bit on /bin/bash for root privilege escalation.README.md:226

Classification basis

The artifact is a writeup. It provides a substantive technical analysis of the attack chain used to compromise a machine, including vulnerability descriptions and code snippets, but it does not contain a functional, self-contained exploit or scanner. The code snippets are illustrative examples within the narrative, not standalone tools.

Requirements

• Access to the Hack The Box 'Bedside' machine network.README.md:50-52
• Ability to upload a malicious PDF and pickle file to the target web application.index.html:1076-1078

Observed behavior

• Describes creating a malicious pickle file that executes a reverse shell command.index.html:1085-1092
• Describes using a path traversal in a PDF to load the malicious pickle file via pdfminer.six.index.html:1096-1101
• Describes using a Vite path traversal to read a developer's SSH private key.index.html:1122-1126
• Describes creating a malicious PyTorch checkpoint to create a SUID bash binary for root escalation.index.html:1161-1168

Observables

Cve Reference

Payload withheldThe writeup documents exploitation of this CVE for educational purposes.README.md:26index.html:1072-1073

Ip Address

Payload withheldExample reverse shell IP address in educational pickle payload code snippet.index.html:1088

Ip Address

Payload withheldExample SSH connection IP address in educational code snippet.index.html:1136

Classification basis

The artifact is a writeup. It provides a substantive technical analysis of the exploitation chain for two CVEs, including reconnaissance, exploitation steps, and privilege escalation. It contains no exploit or scanner code; the commands shown are illustrative examples within a narrative, not functional code intended to be executed.

Requirements

• Access to the target network service on port 80README.md:43-47
• Local user access on the target system for privilege escalationREADME.md:105

Observed behavior

• Describes downloading an unauthenticated backup from Nginx UI and extracting the AES key from the X-Backup-Security headerREADME.md:61-69
• Describes decrypting the backup, extracting a bcrypt hash, and cracking it to obtain SSH credentialsREADME.md:72-94
• Describes compiling and executing a SUID exploit for payload withheld to achieve root privileges via a race condition in snapdREADME.md:107-156

Observables

Cve Reference

Payload withheldThe writeup documents exploitation of this Nginx UI vulnerability for foothold.README.md:28index.html:241-243

Cve Reference

Payload withheldThe writeup documents exploitation of this snapd privilege escalation vulnerability.README.md:29index.html:244-247

External Repository Reference

Payload withheldThe writeup instructs cloning this repository to compile the exploit, but the artifact itself does not contain or execute that code.README.md:110index.html:350

Classification basis

The artifact is a Hack The Box writeup. It provides a step-by-step narrative of an attack, including example curl commands and shell interactions, but does not contain functional exploit or scanner code. The included C code snippet is a non-functional placeholder. The primary purpose is technical analysis and documentation, not automated exploitation or scanning.

Requirements

• Access to the target web application API endpointsREADME.md:49-55
• Ability to register a user account on the targetREADME.md:84-92
• Local access to a vulnerable Linux kernel (5.15.70) for payload withheldREADME.md:188-194

Observed behavior

• Describes using a PUT request to /api/v1/admin/settings/update to escalate a user to admin by setting is_admin=1README.md:96-102
• Describes command injection via the username parameter in a POST to /api/v1/admin/vpn/generate, resulting in remote code execution as www-dataREADME.md:115-135
• Describes lateral movement to the admin user by reading database credentials from a .env file and using SSHREADME.md:160-176
• Describes privilege escalation to root by compiling and executing a public payload withheld exploitREADME.md:196-210

Observables

Cve Reference

Payload withheldThe write-up describes using a public kernel exploit for privilege escalation on a target machine. This is standard educational content for a CTF write-up.README.md:24README.md:184-194

External Repository Reference

Payload withheldThe write-up instructs the reader to clone a public GitHub repository containing a known payload withheld proof-of-concept. This is a reference to an external resource, not a payload within the artifact.README.md:199index.html:598

Non Executable Code Snippet

Payload withheldThe artifact includes a commented, non-functional C code skeleton that describes the logic of an OverlayFS exploit. It is not a complete, compilable, or executable payload and serves only as an illustration.README.md:306-329

Classification basis

The artifact is a write-up documenting the exploitation process for a HackTheBox machine. It contains no executable exploit or scanner code; it only describes commands and steps. The README.md and index.html files are purely descriptive and educational.

Requirements

• Network access to SMB shares with null authenticationREADME.md:24-25
• Writable SMB printer share (HP-Reception)README.md:25

Observed behavior

• Describes using a public PoC for CVE-2026-4480 to obtain a reverse shell as user 'nobody'README.md:27-29
• Describes decoding rclone-obfuscated credentials to gain SSH access as user 'scott'README.md:33-35
• Describes abusing SMB wide links and force user to escalate to user 'marcus'README.md:42-45
• Describes escalating to root by writing a systemd drop-in to set SUID on /bin/bashREADME.md:48-53

Observables

URL

Payload withheldExternal PoC repository referenced in the write-up; not part of the reviewed artifact.README.md:77index.html:268

URL

Payload withheldAuthor's portfolio link in the HTML footer.index.html:351

Classification basis

The artifact is a Hack The Box writeup containing a narrative description of an attack chain, example commands, and screenshots. It does not contain any executable exploit or scanner code; it is a technical analysis document.

Requirements

• Target running CraftCMS 5.6.16README.md:47
• Target running GNU inetutils telnetd 2.7README.md:212

Observed behavior

• Describes using Metasploit module exploit/linux/http/craftcms_preauth_rce_cve_2025_32432 to gain a reverse shellREADME.md:128-135
• Describes using USER="-f root" telnet -a 127.0.0.1 to bypass authentication and gain root accessREADME.md:226-228

Observables

Educational Content

Payload withheldThe repository is a static writeup with no executable components; it documents known vulnerabilities for educational purposes.README.md:1-296index.html:1-688