Traverxec

Platform: HackTheBox | Difficulty: Easy | OS: Debian Author: D3v0o0Nu11 | Date: 2026-02-10 | Status: Solved

Summary

Walkthrough of the HackTheBox machine Traverxec (Debian, attack surface: OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0) (22), nostromo 1.9.6 (80)). Foothold via the vulnerable entry point; privilege escalation to root. Both flags captured and redacted.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC 10.10.10.165 --min-rate 1000 -Pn

Enumeration highlights

• Detected OS: Debian.
• Open services: http (80), ssh (22).
• Scan used: nmap -p- -sV -sC 10.10.10.165 --min-rate 1000 -Pn.

Foothold

Vulnerability / Misconfiguration

┌──(D3v0o0Nu11㉿htb)-[~]
└─$ nmap -p- -sV -sC 10.10.10.165 --min-rate 1000 -Pn
Starting Nmap 7.93 ( https://nmap.org ) at 2024-01-22 01:12 PST
Nmap scan report for 10.10.10.165
Host is up (0.25s latency).
Not shown: 65533 filtered tcp ports (no-response)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u1 (protocol 2.0)
| ssh-hostkey: 
|   2048 aa99a81668cd41ccf96c8401c759095c (RSA)
|   256 93dd1a23eed71f086b58470973a388cc (ECDSA)
|_  256 9dd6621e7afb8f5692e637f110db9bce (ED25519)
80/tcp open  http    nostromo 1.9.6
|_http-server-header: nostromo 1.9.6
|_http-title: TRAVERXEC
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 147.43 seconds

1. Based from the nmap results, the machine runs a web application and opens ssh login at port 22.

2. Enumerating endpoint or files using dirsearch shall resulting to no interesting result.

3. Scrolling down the webapp, found a contact form.

4. After tried to sent message, got result which indicates this form is not our interest.

5. Based from the nmap result for port 80, we can identified that the web server is nostromo 1.9.6.

6. Searching on the internet for CVE related to that service's version, shall resulting to these exploitDB and github POC.

RESULT OF USING THE GITHUB'S POC

1. Great! Using the github's poc shall helps us grab the user flag.

Proof

User flag: REDACTED

Privilege Escalation

User -> Root/Admin

1. Sadly we don't have permission to access david's home directory. Checking nostromo configuration file might help us.

2. Let's enumerate the service's directory --> /var/nostromo.

3. Checking what's inside nhttpd.conf shall resulting to another interest again.

4. So far we identified that we can get the user's password hash by checking .htpasswd and we identified HOMEDIRS section.

NOTES:

Based from the above result, the HOMEDIRS section determines that public_www directory might be inside the david's home directory. Even though david's home is not accessible by other user but public_www is accessible.

1. hashid identified several MD5 algorithms.

2. Let's crack it with john and used the cracked password to login as david.

3. BUT, we failed to login as david.

Root flag: REDACTED

Flags

Lessons Learned

1. Exploiting nostromo 1.9.6.