HackTheBox - CodePartTwo
Source: YouTube · IppSec · published Jan 31, 2026 · 15:42
BLUF: This Hack the Box walkthrough details exploiting a JS2IPython sandbox escape via a specific CVE to achieve initial code execution, followed by privilege escalation through a misconfigured np-backup utility to extract the root SSH key 0:00.
Key Takeaways:
• The target is a web-based IDE using JS2IPython; despite import blocking, the open-source nature reveals the underlying technology and potential vulnerabilities 0:08.
• Initial access is gained by exploiting a known CVE in JS2IPython that bypasses the sandbox restrictions, allowing remote code execution 0:17.
• Post-exploitation involves dumping the SQLite database, cracking unsalted MD5 hashes to find the password for user 'Marco', and logging in 0:21.
• Privilege escalation is achieved by manipulating the np-backup utility's configuration to back up the root directory, bypassing intended restrictions 0:26.
• The root SSH private key is extracted from the backup snapshot, granting full root access to the system 0:30.
The scenario highlights the critical risks of unpatched open-source dependencies and insecure sudo configurations that facilitate complete system compromise.
Sources:
- 0:00 Introduction to the Code Part Two machine and its web-based IDE.
- 0:08 Analysis of the Python environment and JS2IPython sandbox.
- 0:13 Identifying the open-source application and potential vulnerabilities.
- 0:17 Exploiting the JS2IPython CVE for initial shell access.
- [0:21](https://www.youtub
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing code part two from Hack the Box which is a nice and easy machine that starts out with a web- based IDE that lets us run Python code. The usage of imports is blocked which makes it challenging to get a shell but the website is open source and we can see it's using JS2PI to create the sandbox that runs code. Looking into CVEs, we find a sandbox escape that lets us get a shell onto the box. And with access to the box, we can start cracking passwords in the database to get access to another user which can run a backup utility via pseudo. So looking into this utility, we create a backup job to back up this root directory. And that gets us the flag and also the SSH key. So with that being said, let's just jump in. As always, we're go…