Skip to main content
CPEBuddy
HackTheBox - Instant

HackTheBox - Instant

Source: YouTube · IppSec · published Mar 1, 2025 · 28:22

Penetration Testing
No ratings yet Log in to rate
Transcript Available
Description

The video demonstrates rooting the "Instant" Hack The Box machine by exploiting a hardcoded JWT in an Android app to access an API, leading to an SSH key disclosure and subsequent privilege escalation via a SolarWinds Putty configuration.

Key Takeaways:
• The initial foothold is gained by downloading an APK, decompiling it with Jadx, and identifying a hardcoded JWT that grants administrative API access 0:22.
• The API contains a file disclosure vulnerability that allows the attacker to read sensitive files, including an SSH private key 0:32.
• Using the extracted SSH key provides initial access to the target machine 0:35.
• Privilege escalation to root is achieved by exploiting a SolarWinds PuTTY configuration file found on the system 0:38.

This walkthrough highlights the importance of auditing mobile applications for hardcoded secrets and understanding how API vulnerabilities can lead to full system compromise.

Sources:

  • 0:00 Introduction to the Instant machine challenge.
  • 0:22 Discovery of the hardcoded JWT in the decompiled app.
  • 0:32 Exploitation of the file disclosure vulnerability.
  • 0:35 Gaining SSH access using the stolen key.
  • 0:38 Finding the PuTTY config for root escalation.

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

what's going on YouTube this is IPC and today we'll be doing instant from hack the box which is a relatively straightforward machine that starts with downloading an Android application off a web server and we can decompile that with Jad X and the first thing I normally look for when decompiling an app are what endpoints it talks to this reveals an API along with a Swagger interface which is live documentation on how to interact with the API unfortunately many of the endpoints require administrative access so we look at the app and discover a hardcoded JWT which provides us that access the API has a file disclosure vulnerability which we can use to read an SSH key that gets us onto the box and once there we discover a solar putty configuration which doing some light Googling we discover a w…