Analytics

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Analytics (Ubuntu, attack surface: OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.233 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.233 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.233 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-10-18 20:52 PDT
Nmap scan report for 10.10.11.233
Host is up (0.084s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.4 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 3eea454bc5d16d6fe2d4d13b0a3da94f (ECDSA)
|_  256 64cc75de4ae6a5b473eb3f1bcfb4e394 (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://analytical.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 85.17 seconds

1. Based from the nmap results, the machine runs a web application and opens ssh logins.

2. After ran dirsearch found nothing interesting.

3. Enumerating subdomain for the host found one result.

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ ffuf -w SecLists/Discovery/DNS/subdomains-top1million-5000.txt -u http://10.10.11.233 -H "Host: FUZZ.analytical.htb" -mc all -ac

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.0.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.10.11.233
 :: Wordlist         : FUZZ: /home/D3v0o0Nu11/SecLists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.analytical.htb
 :: Follow redirects : false
 :: Calibration      : true
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: all
________________________________________________

[Status: 200, Size: 77883, Words: 3574, Lines: 28, Duration: 68ms]
    * FUZZ: data

:: Progress: [4989/4989] :: Job [1/1] :: 1388 req/sec :: Duration: [0:00:04] :: Errors: 0 ::

data.analytical.htb

1. Now we're given a metabase login page. Searching on Google about it's vuln found several results of it:

2. Checking metasploit for this module found one result which corresponds the previous result we got.

USING IT

1. Got shell! But sadly it does not have python3 running, hence we can't get a stable shell.

2. Somehow the user.txt is not there, hence we need to enumerate dirs and files to find config file or .db file.

3. At the / diretory found a .db directory which holds two DBs file.

4. The first .db file --> metabase.db.mv.db should be our interest (because it holds big information, but still taks long time to analyze), so I tried to enumerate other aspect.

5. Running ls -a shows .dockerenv, hence let's run env command.

6. Great! We found cred --> metalytics:An4lytics_ds20223#.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Exploit metabase login page.
2. Local Privesc Ubuntu 22