Horizontall

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Horizontall (Ubuntu, attack surface: OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) (22), nginx 1.14.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.11.105 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sVC 10.10.11.105 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.11.105 --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-14 04:24 PDT
Nmap scan report for 10.10.11.105
Host is up (0.031s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 ee774143d482bd3e6e6e50cdff6b0dd5 (RSA)
|   256 3ad589d5da9559d9df016837cad510b0 (ECDSA)
|_  256 4a0004b49d29e7af37161b4f802d9894 (ED25519)
80/tcp open  http    nginx 1.14.0 (Ubuntu)
|_http-title: Did not follow redirect to http://horizontall.htb
|_http-server-header: nginx/1.14.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 29.63 seconds

1. Based from the nmap results, the machine runs a web application and opens a ssh login.

2. After clicking and checking every feature available there, none of the button redirecting us to a homepage.

3. Then I ran dirbuster.

4. http://horizontall.htb/js/app.c68eb462.js should be our interest.

5. Let's deobfuscate the js with --> https://deobfuscate.io/

DEOBFUSCATE RESULT -> Found a subdomain that could be our interest.

1. Found nothing, let's run dirbuster.

2. This could be our foothold, strapi is an open source node.js Headless CMS (separates the presentation layer where content is presented from the backend where content is managed.

use searchsploit

1. Seems we need to identify the strapi version used. The problem is, I already used burpsuite and whatweb to do information gathering.

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ whatweb http://api-prod.horizontall.htb/admin/auth/login
http://api-prod.horizontall.htb/admin/auth/login [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[Ubuntu Linux][nginx/1.14.0 (Ubuntu)], IP[10.10.11.105], Script[text/javascript], Strict-Transport-Security[max-age=31536000; includeSubDomains], Title[Strapi Admin], UncommonHeaders[content-security-policy], X-Frame-Options[SAMEORIGIN], X-Powered-By[Strapi <strapi.io>], X-XSS-Protection[1; mode=block], nginx[1.14.0]

1. Anyway we can make an interpretation, since we don't have any cred. Our interest shall be around the 3rd and 4th exploit.

2. To copy the script to our current directory, run --> searchsploit -m 50239.py.

3. Reading the script at glance, seems we can check the strapi version by changing the url to --> /admin/init.

4. Great we found the version --> 3.0.0-beta.17.4.

5. Based from the main() function we can run --> python3 script url to execute the script (because there's sys.argv[1]).

6. Great! Let's run a listener to do reverse shell and send our template bash reverse shell.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Generating ssh-keygen to get a stable shell at the remote server.
2. Port forwarding from remote server to local server.
3. Exploiting Laravel 8.4.2