ScriptKiddie

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine ScriptKiddie (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0) (22), Werkzeug httpd 0.16.1 (Python 3.8.5) (5000)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.10.226 --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (5000), ssh (22).
• Scan used: nmap -p- -sV -sC 10.10.10.226 --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~/Downloads]
└─$ nmap -p- -sV -sC 10.10.10.226 --min-rate 1000    
Starting Nmap 7.93 ( https://nmap.org ) at 2023-12-24 01:47 PST
Nmap scan report for scriptkiddie.htb (10.10.10.226)
Host is up (0.019s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.1 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3c656bc2dfb99d627427a7b8a9d3252c (RSA)
|   256 b9a1785d3c1b25e03cef678d71d3a3ec (ECDSA)
|_  256 8bcf4182c6acef9180377cc94511e843 (ED25519)
5000/tcp open  http    Werkzeug httpd 0.16.1 (Python 3.8.5)
|_http-server-header: Werkzeug/0.16.1 Python/3.8.5
|_http-title: k1d'5 h4ck3r t00l5
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 73.05 seconds

1. Based from the nmap results, the machine runs a web application at port 5000 hosted with Werkzeug httpd 0.16.1 webserver and it opens ssh login.

2. Let's see if we can get the same result as our previous nmap scans by submitting localhost ip.

Turns out we get the same result.

1. Well, I assume this webapp provides the same functional as our own tools in kali.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

Escalated from the kid foothold by abusing the msfconsole application path — the world-writable hackers log file was consumed by a root-owned scheduled job, yielding a root shell.

Root flag: REDACTED

Flags

Lessons Learned

1. asdjkasnd