Optimum

Platform: HackTheBox | Difficulty: Easy | OS: Windows Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Optimum (Windows, attack surface: HttpFileServer httpd 2.3 (80)). Foothold via the vulnerable entry point; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sVC 10.10.10.8 --min-rate 1000

Enumeration highlights

• Detected OS: Windows.
• Open services: http (80).
• Scan used: nmap -p- -sVC 10.10.10.8 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sVC 10.10.10.8 --min-rate 1000 
Starting Nmap 7.93 ( https://nmap.org ) at 2023-09-07 18:18 PDT
Nmap scan report for optimum.htb (10.10.10.8)
Host is up (0.023s latency).
Not shown: 65534 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
80/tcp open  http    HttpFileServer httpd 2.3
|_http-title: HFS /
|_http-server-header: HFS 2.3
Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 112.60 seconds

1. Based from the nmap result, the machine's runs a web application, also we know the version of the HttpFileServer.

2. Throw it on Google, I found an exploit DB about this HttpFileServer's version --> https://www.exploit-db.com/exploits/39161.

3. To solve this challenge, I used metasploit.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.