HackTheBox - Titanic
Source: YouTube · IppSec · published Jun 21, 2025 · 24:35
The Hack the Box "Titanic" machine is an easy challenge involving a chained exploitation path: a Flask application's file disclosure vulnerability exposes Gitea internals, allowing credential extraction and SSH access, which leads to a root compromise via an ImageMagick library injection vulnerability triggered by a cron job 0:00-0:37.
Key Takeaways:
• A file disclosure vulnerability in the Flask booking app allows reading /proc/self/environ and source code, revealing the Gitea SQLite database path 0:07-0:13.
• Extracting the Gitea database via the dev subdomain and cracking the user hash provides SSH credentials for the developer user 0:13-0:21.
• Enumeration reveals a cron job running an outdated ImageMagick version on JPEG files, which is exploited via an LD_PRELOAD library injection to gain root access 0:24-0:37.
This walkthrough demonstrates how identifying default configurations and outdated dependencies can bridge the gap between initial web access and full system compromise.
Sources:
- 0:00 Introduction to the Titanic Hack the Box machine.
- 0:07 Identification of the web file disclosure vulnerability.
- 0:13 Discovery of Gitea and the plan to dump the database.
- 0:17 Exploiting file disclosure to access Gitea-sqlite.
- 0:24 Discovery of the ImageMagick cron job vulnerability.
- 0:33 Exploiting the vulnerability to execute code as root.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is IPS doing Titanic from Hack the Box, which is a nice easy box that starts off with a web page that supposedly cannot fail. It allows us to book trips on the Titanic. And this function is vulnerable to a file disclosure vulnerability. Poking around, we also discover git t is running. And we can use this file disclosure vulnerability to dump the git tsqlite database crack credentials and SSH into the box. Poking around, we discover there is a cron that is running an outdated version of image magic. And going to Google, it shows this version is vulnerable to a path injection-l like vulnerability that allows us to run code as root. So with that being said, let's just jump in. As always, we're going to start with the end map. So - SC for default scripts, SV enu…