Stocker

Platform: HackTheBox | Difficulty: Easy | OS: Ubuntu Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Stocker (Ubuntu, attack surface: OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) (22), nginx 1.18.0 (Ubuntu) (80)). Foothold via the vulnerable entry point; privilege escalation via sudo. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC stocker.htb --min-rate 1000

Enumeration highlights

• Detected OS: Ubuntu.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC stocker.htb --min-rate 1000.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC stocker.htb --min-rate 1000
Starting Nmap 7.93 ( https://nmap.org ) at 2024-05-06 01:43 PDT
Nmap scan report for stocker.htb (10.10.11.196)
Host is up (0.020s latency).
Not shown: 65533 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 3d12971d86bc161683608f4f06e6d54e (RSA)
|   256 7c4d1a7868ce1200df491037f9ad174f (ECDSA)
|_  256 dd978050a5bacd7d55e827ed28fdaa3b (ED25519)
80/tcp open  http    nginx 1.18.0 (Ubuntu)
|_http-generator: Eleventy v2.0.0
|_http-title: Stock - Coming Soon!
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 16.52 seconds

1. Based from the nmap results, the machine runs a web application on port 80 and it opens ssh logins on port 22.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

Leveraged the sudo entry for nodejs to read files outside the webroot with elevated privileges and capture the root flag.

Root flag: REDACTED

Flags

Lessons Learned

1. sdasda