HackTheBox - Fries
Source: YouTube · IppSec · published Jul 25, 2026 · 1:27:36
The video demonstrates a full compromise of the Hack The Box "Fries" machine, starting with Linux enumeration and ending with Active Directory privilege escalation to Domain Admin.
Key Takeaways:
• Initial reconnaissance identified a nested Linux/Windows environment via TTL analysis, revealing services like SSH, DNS, and an embedded PWM service 1:11-2:15.
• A Git repository leak exposed credentials for a PgAdmin instance, which was exploited to achieve Remote Code Execution (RCE) and obtain a shell 9:26-18:36.
• The attacker leveraged NFS misconfiguration and UID spoofing to access SSL certificates, allowing authentication against the Docker daemon 40:01-56:43.
• Root access on the Linux host revealed cracked passwords for the PWM service, which were used to extract LDAP credentials and map the Active Directory structure 57:43-1:06:47.
• Final privilege escalation involved exploiting the Certificate Authority via ESC6 and ESC16 vulnerabilities to forge a certificate for the Administrator account 1:10:22-1:27:32.
The attack path highlights the critical importance of securing Docker APIs, auditing Git history for leaked secrets, and properly configuring Active Directory Certificate Services permissions.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we're doing fries from hack the box which is a pretty big box that starts off with Linux and ends with Windows. It's assumed breach. So we start out with a set of credentials but it doesn't tell us exactly where they go. But after doing a lot of um enumeration we discover a git t instance and can log in. This git t instance gives us information about a pg admin container and we can find where that is get a shell on it and then that gives us some credentials to log into the host via SSH. After poking around, we discover Docker is set up to off via SSL and NFS is running. We can abuse NFS to read the SSL searchs, allowing us to authenticate against Docker and then create a image that has the root host mountain, so we can get root pretty easily …