HackTheBox - Pterodactyl
Source: YouTube · IppSec · published May 16, 2026 · 57:49
This Hack The Box machine, Pterodactyl, leverages a complex chain of vulnerabilities starting with a Local File Inclusion (LFI) in the Pterodactyl game server management panel 0:02. The exploitation requires precise enumeration to achieve remote code execution, followed by privilege escalation through outdated PAM and UDisks components.
Key Takeaways:
• The initial attack vector involves an LFI vulnerability within the Pterodactyl panel, which is an open-source game server management platform 0:09.
• Exploiting the LFI is not straightforward; attackers must first identify the installation path of PHP PEAR to successfully trigger code execution 0:14.
• The first privilege escalation relies on an outdated library within PAM, allowing the impersonation of a physically logged-in user 0:28.
• The final privilege escalation step exploits permissions related to UDisks, which is often overlooked in standard enumeration 0:32.
This machine demonstrates that CVE-based challenges often require deep understanding of system internals and non-obvious exploitation paths rather than just applying known exploits.
Sources:
- 0:02 Introduction to the Pterodactyl Hack The Box machine
- 0:09 Description of Pterodactyl as a game server management platform
- 0:14 Details on the Local File Inclusion vulnerability
- 0:19 Enumeration of PHP PEAR installation for LFI
- 0:28 Explanation of the PAM vulnerability for user impersonation
- 0:32 Overview of the UDisks permissio
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is Ippsec, and today we're doing Pterodactyl from Hack The Box, which is heavily CVE based, but it's nowhere near straightforward. It starts off with discovering the Pterodactyl panel, which I think is an open source game server management platform. I don't know exactly what it is. It has a local file inclusion vulnerability, but it's not straightforward to exploit because you have to discover where PHP PEAR is installed, and first you have to enumerate that that's the reason it's failing. But once you do that, you can get code execution on the box. And then the second priv esc can be a little bit hard to find because it's an outdated library within PAM and something called UDisks. The PAM vulnerability allows you to impersonate a physically logged in user. An…