Shoppy

Platform: HackTheBox | Difficulty: Easy | OS: N/A Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Shoppy. Foothold via sql injection; direct root access from the foothold. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -sVC -p- <IP> -oA nmap/Shoppy

Enumeration highlights

Foothold

Vulnerability / Misconfiguration

1. First, let's check all open ports and it's services from the host given.

2. Based from the open ports. We know the machine is running a web application and there's port 9093 which has copycat service.

3. I did a small outsource about copycat service. Turns out it's a database replication service.

4. In general the data stored in JSON format, hence we know the vuln here is no sql injection.

5. Let's run gobuster to see all availables directories and files.

6. Actually we got many directories and files, but we only can open the admin, Admin, login, and Login.

7. All of it leads to this webpage.

8. Since we already know the vuln is nosqli i use this as my references.

9. Let's enter both username and pass as admin'||'1==1'.

10. Now click the search button.

11. Enter the same input as before to textbox.

12. When i tried to cracked the admin's hash, seems the plaintext is not leaked in the internet. Then i tried for josh. Got this:

13. I tried to login ssh with josh as the username and the password as the plaintext we cracked.

14. But it says wrong password.

15. Let's use another approach.

16. Maybe let's use fuff to checks if there are any subdomains available.

ffuf -u http://shoppy.htb -H "Host: FUZZ.shoppy.htb" -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -mc all

1. Since there's many responses with size of 169. Let's filter it.

ffuf -u http://shoppy.htb -H "Host: FUZZ.shoppy.htb" -w /usr/share/wordlists/SecLists-master/Discovery/DNS/bitquark-subdomains-top100000.txt -mc all -fs 169

-u -> stands for target URL
-H -> stands for header.
-w -> stands for wordlist file path.
-mc -> stands for match http status code.
-fs -> stands for filter http response size.

1. Got it!
2. Now place the subdomain to /etc/hosts first, then open it on the web browser.

ON THE WEB BROWSER

1. Now let's enter josh creds.

2. It looks like we have another username here.

3. Let's check every channels here.

4. Got a creds at Deploy Machine channel.

5. Let's try ssh to login now.

username: josh
password: Sh0ppyBest@pp!

25 Got the user flag!

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

The exploit provided a shell running with elevated privileges directly, so no separate privilege escalation was required.

Root flag: REDACTED

Flags

Lessons Learned

1. Enumerate everything; version strings map to CVEs.
2. Confirm each hypothesis with a test before building the exploit.
3. Chain foothold -> privilege escalation mechanically.