HackTheBox - Pterodactyl

IppSec · Beginner ·🔐 Cybersecurity ·1h ago
01:05 - Start of nmap 04:00 - Using ffuf to find the panel subdomain, which shows pterodactyl.htb 06:30 - Discovering the version of pterodactyl running by looking at the GitHub Releases and looking for the js bundle name 10:00 - Searching CVE's finding the Pterodactyl CVE-2025-49132 POC, and running an exploit script 17:00 - Finding PHP PEAR directory which allows our exploit to run 19:05 - Looking at the source code, and running through the exploit manually 36:00 - Shell on the box dump the database, crack a cred to get an account 43:40 - Looking at CVE-2025-6018 which lets us impersonate a physical logged in user in policy kit 46:25 - Exploiting CVE-2025-6019 which is a CVE in UDISKS, when it does the resize it mounts a partition without the NOSUID flag 52:55 - Starting a script to execute bash in our malicious mount, then telling udisks to resize it and getting a shell
Watch on YouTube ↗ (saves to browser)
Sign in to unlock AI tutor explanation · ⚡30

Related AI Lessons

⚡
Synthesizing the Principles-Building Your Cohesive Security Blueprint
Learn to build a cohesive security blueprint by synthesizing key cybersecurity principles
Medium · Cybersecurity
 ⚡
Security Through Obscurity-A Clever Tactic, But a Terrible Strategy
Learn why Security Through Obscurity is a flawed strategy for protecting digital systems and what alternatives can be used instead
Medium · Cybersecurity
 ⚡
American Lending Center Data Breach Impacts 123,000 Individuals: What Financial Institutions Must…
American Lending Center's data breach affects 123,000 individuals, highlighting the need for financial institutions to prioritize cybersecurity
Medium · Cybersecurity
 ⚡
Secure by Design-Building Foundations, Not Fixing Flaws
Learn to prioritize security from the ground up to avoid costly fixes later, a crucial mindset for developers and cybersecurity professionals
Medium · Cybersecurity

Chapters (10)

1:05 Start of nmap
4:00 Using ffuf to find the panel subdomain, which shows pterodactyl.htb
6:30 Discovering the version of pterodactyl running by looking at the GitHub Releas
10:00 Searching CVE's finding the Pterodactyl CVE-2025-49132 POC, and running an exp
17:00 Finding PHP PEAR directory which allows our exploit to run
19:05 Looking at the source code, and running through the exploit manually
36:00 Shell on the box dump the database, crack a cred to get an account
43:40 Looking at CVE-2025-6018 which lets us impersonate a physical logged in user i
46:25 Exploiting CVE-2025-6019 which is a CVE in UDISKS, when it does the resize it
52:55 Starting a script to execute bash in our malicious mount, then telling udisks
Up next
Top 7 Free Cybersecurity Courses With Certificates | Learn Cybersecurity For Free | Simplilearn
Simplilearn
Watch →