Blunder

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Blunder (Ubuntu, attack surface: Apache httpd 2.4.41 ((Ubuntu)) (80), ftp (21)). Foothold via the vulnerable entry point; privilege escalation via sudo. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC blunder.htb --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: ftp (21), http (80).
• Scan used: nmap -p- -sV -sC blunder.htb --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC blunder.htb --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2024-05-13 20:47 PDT
Nmap scan report for blunder.htb (10.10.10.191)
Host is up (0.017s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE  SERVICE VERSION
21/tcp closed ftp
80/tcp open   http    Apache httpd 2.4.41 ((Ubuntu))
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Blunder | A blunder of interesting facts
|_http-generator: Blunder

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 133.26 seconds

1. Based from the nmap results above, the machine runs web application at port 80 and opens ssh login at port 21.

2. Checking each feature available at the website, none of it seems to be our interest. Upon running dirsearch found several endpoints.

3. Accessing /todo.txt endpoint, noticed that CMS is not updated yet. Hence the CMS seems should be exploited. Also noticed it stated a person named fergus.

4. Great! Now let's access the /admin endpoint.

BLUDIT CMS

1. Checking the page source, we can identified the CMS version is 3.9.2.

2. Searcing on the internet and using searchsploit to identified vulns for the related version, resulting to these:

3. Interesting, we got few options. However, among all of it seems bruteforce should be our interest.

Privilege Escalation

User -> Root/Admin

Recovered credentials from the Bludit user database (bl-content/users) and leveraged the corresponding user's sudo privileges to obtain a root shell.

Flags

Lessons Learned

1. Bludit CMS Exploitation.