HackTheBox - Nocturnal
Source: YouTube · IppSec · published Aug 16, 2025 · 54:39
This video demonstrates the exploitation of the Hack the Box machine "Nocturnal," focusing on file enumeration, credential harvesting, and command injection via line breaks.
Key Takeaways:
• The initial web interface allows file uploads and exposes a username GET parameter vulnerable to fuzzing for user enumeration 0:09.
• Attackers can download files from other users, one of which contains hardcoded credentials for a specific account 0:15.
• Logging in with harvested credentials grants access to an admin panel revealing application source code 0:21.
• A command injection vulnerability exists where the filter misses the newline character, bypassing restrictions on special characters 0:30.
• Successful exploitation allows remote code execution and access to a local service running on localhost 0:36.
The walkthrough highlights how overlooked input filtering characters can lead to full system compromise.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC. I'm doing Nocturnal from Hack the Box, which starts out with seeing a web page that lets you register and upload files. If you look at the get parameters, you'll see username is one of them. And by fuzzing this variable, you'll be able to enumerate and download another user's files, which one of the users has a document that has their password. Logging in as this user reveals an admin panel where you can see the source of the application and also discover a command injection vulnerability that does filter many special characters that lead to code execution. However, a common missed character is the line break itself which will let you get onto the box and once here you discover another website is running on local host and is vulnerable to a 2023 CVE. …