Ambassador

Platform: HackTheBox | Difficulty: Medium | OS: N/A Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Ambassador. Foothold via CVE-2021-43798, arbitrary file read; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -sVC -p- <IP> -oA nmap/Ambassador

Enumeration highlights

Foothold

Vulnerability / Misconfiguration

1. First, scan all open ports and it's services from the host given.

2. Based from the output we know that the machine is running a web application, hence let's open it.

3. Remember there's port 3000 with ppp? as it's service.

4. Based from it's info, it opens a login page.

5. I did a small outsource about grafana and found CVE about grafana exploit.

6. Let's use the script from the github documentation.

Privilege Escalation

User -> Root/Admin

Exploited Grafana CVE-2021-43798 (arbitrary file read) to leak the Consul token, then abused the Consul agent API to register a service that executed a command as root.

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.