HackTheBox - Code
Source: YouTube · IppSec · published Aug 2, 2025 · 39:57
This video demonstrates a walkthrough of the HackTheBox "Code" machine, highlighting initial access via a filtered Python code execution web app and a tricky privilege escalation step involving the sticky bit 0:03.
Key Takeaways:
• The machine is generally easy but contains a specific root privilege escalation trap if users run exploits from temporary directories like /dev/shm or /tmp 0:03.
• The root step fails if run from temp directories because the sticky bit is set, which prevents the root user from modifying the necessary exploit files 0:09.
• Initial shell access is achieved through a website that allows users to execute Python code 0:20.
• The Python execution environment has a filter blocking common malicious commands, requiring the use of sandbox evasion techniques or cheat sheets to bypass 0:24.
The creator promises a thorough explanation of the sticky bit issue at the end of the video after manually demonstrating how to bypass the Python filter.
Sources:
- 0:03 Introduction to the Code machine and the temp directory root exploit trap
- 0:09 Explanation of how the sticky bit prevents root from modifying files in temp directories
- 0:20 Identifying the Python code execution website as the initial attack vector
- 0:24 Discussing the input filter and sandbox evasion techniques to bypass it
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSAC be doing code from hack the box which is a pretty easy machine but there is definitely something that could trip people up during the root step if they try to run the exploit out of a temp directory like dev shm ortemp because the sticky bit is set there which is preventing root from modifying files. I'll do a thorough explanation at the very end of the video. But before we get into the priv, we first have to get a shell on the box and that is through a website that allows us to just run Python code. But there is a filter in place that's preventing a lot of uh bad words from being said. This step's pretty easy if you just pull up a sandbox evasion cheat sheet and try proof of concepts until they work. But I'll do my best to do it manually and explain …