HackTheBox - Nimbus
Source: YouTube · IppSec · published Nov 14, 2026 · 1:03:29
This walkthrough covers Hack the Box's "Nimbus," chaining SSRF into AWS metadata credential theft, SQS YAML deserialization for a shell 0:12-0:33, then a privileged CodeBuild Docker escape to root 60:02-63:20.
Key Takeaways:
• Recon shows SSH (22) and HTTP (80); the site leaks aws.nimbus.htb, a LocalStack-style AWS emulation endpoint 1:17-2:25
• The job submitter's URL field enables SSRF; blocking is bypassed by octal-encoding the IMDS IP, yielding an ASIA (STS) role key 9:16-11:01
• With the STS key, SQS enumeration finds the "flocky" queue; sending is allowed though receiving is denied, so a YAML deserialization payload (PayloadsAllTheThings) delivers a reverse shell 17:01-20:51
• Env vars expose a long-form AKIA key enabling message reads; the Flocky health endpoint reveals CodeBuild running in privileged Docker mode—the under-hinted escalation path 24:32-28:33
• Root: hijack id via exported bash functions to spoof a non-root user, then a modprobe Docker escape writes an SSH key to the host overlay filesystem 39:50-60:02
Nimbus tests SSRF, AWS metadata abuse, message-queue deserialization, and container escapes, though the presenter felt the CodeBuild pivot lacked fair hints.
Sources:
- 0:12-0:33 Attack chain overview
- 9:16-11:01 SSRF and STS credential theft
- 17:01-20:51 YAML deserialization and shell
- 39:50-60:02 Privileged Docker escape to root
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on, YouTube? This is IPSC, and today I'll be doing Nimbus from Hack the Box, which if you couldn't tell by the name, it is all about the cloud. And this is one of the boxes I struggled with a lot because I feel the route was a little bit unfair. However, before we get there, I did enjoy the foothold a lot. We find a serverside request forgery that enables us to enumerate the instance metadata service, IMDS, and then configure our AWS CLI to poke at AWS SQS, the simple Q service. and we'll send a exploit within a message to um take advantage of a Python YAML dialization vulnerability to get a shell. Once we get the shell is where the box becomes incredibly tough um primarily because there's a vulnerability in the code build service, but not much information at all points to tha…