HackTheBox - Cobblestone
Source: YouTube · IppSec · published Aug 15, 2026 · 1:03:18
This video is a walkthrough of the Hack the Box "Cobblestone" machine (insane), chaining SQL injection, XSS/CSRF session theft, SSTI, database dumping for SSH, and a root Cobbler XML-RPC exploit 0:00.
Key Takeaways:
• SQL injection in the "suggest" URL field: enumerated with order by (five columns), exploited via UNION SELECT, automated with sqlmap 5:49
• PHP session cookie is HTTPOnly, so XSS is used to exfiltrate the victim's page HTML, revealing a phpinfo page that leaks cookies—enabling a second payload to steal the admin session 17:22
• SSTI in a Twig template's first name field gives command execution, but AppArmor restricts most binaries, pipes, and reverse shells 28:18
• Reading the AppArmor profile at /etc/apparmor.d/apache2.d/cobblestone shows mysqldump is allowed; dumping the DB and cracking the SHA-256 hash ("ilovedannymorethanyou") yields SSH access as cobble in an rbash jail 33:43
• ss reveals a localhost-only Cobbler XML-RPC service on port 25151; after SSH tunneling, an auth bypass (login with password -1 as an integer) plus command injection—exploit scripted with Claude AI—yields root 48:19
The box shows that thorough recon matters more than exploit difficulty, and highlights AI's usefulness for quickly building exploit scripts from unpolished vulnerability reports.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is Ipsac, and today we're doing Cobblestone from Hack the Box, which is an insane machine, but like most insanes, it's on the easier side if you're good at recon. We have a cross-ite scripting vulnerability, but the PHP session cookie is marked HTTP only. So, while we can control the victim's browser through Crossite request forgery, we can't steal the cookies, at least easily. Sending the page the victim is on back to us shows a link to a debug page. This page runs PHP info which gives a lot of information but most importantly the cookies in the request. So we can use CSRF again to have the victim navigate to and send us the output of the debug page and this allows us to steal their session. From here we can find a SSTI vulnerability in the PHP template engi…