Cybersecurity

Hack The Box : Cohort Full Walkthrough ( Linux ; Very Easy )

48 sec read0 views0 listens

The write-up for the Hack The Box machine "Cohort" provides a detailed walkthrough of exploiting a Linux system. Here's a summary and key points from the write-up:

Initial Reconnaissance

Port Scanning: Identified open ports 22 (SSH), 80 (HTTP), and 443 (HTTPS).
Web Application Discovery:
- Found a WebSocket endpoint at ws://10.10.10.159:80/.
- Discovered an API route /api/v1/auth that accepts WebSocket connections.

Exploitation

Unauthenticated Code Execution as Marimo

WebSocket Handshake: The machine uses a custom WebSocket server with no authentication for the /api/v1/auth endpoint.
Exploit Development:
- Created a Python script to establish a WebSocket connection and send commands.
- Sent an unauthenticated command id; whoami; hostname to confirm that it executes as user "marimo".

Privilege Escalation (CVE-2026–41651)

PackageKit Vulnerability: Identified PackageKit version 1.2.8,

Read the full article at InfoSec Write-ups - Medium

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.

You Might Like

Cybersecurity11 hours ago58 sec read

From SQL Injection to Remote Code Execution: Following an Unexpected Attack Chain

The write-up describes a security researcher's journey from exploiting an SQL injection vulnerability to gaining remote code execution (RCE) on a shared hosting server. Here’s a detailed breakdown of the process: Initial Discovery: SQL Injection Vuln...

Ali Nemati

Cybersecurity11 hours ago24 sec read

Try Hack Me Hackerholidays Day7 Do Not Disturb Walkthrough

A cybersecurity walkthrough details a successful SQL injection attack against a web application during a Try Hack Me challenge. This highlights vulnerabilities in form-encoded login pages and demonstrates various payload techniques for different data...

Ali Nemati

Cybersecurity1 day ago23 sec read

A Note on Pentesting Passkeys

A penetration tester has developed JavaScript helper functions to inspect and manipulate Web Authentication API calls for passkey testing. This tool allows for deeper assessment of passkey implementations, crucial for cybersecurity professionals veri...

Ali Nemati