HackTheBox - Browsed
Source: YouTube · IppSec · published Mar 28, 2026 · 39:03
This video demonstrates a Hack The Box machine called "Browse," where the attack chain exploits a browser extension testing website combined with a local command injection vulnerability to achieve remote code execution 0:02-0:15.
Key Takeaways:
• The initial attack surface involves a website designed to test browser extensions and a separate application running on localhost with a command injection flaw 0:04-0:10
• A custom malicious browser extension is created to target the localhost application, triggering the RCE and establishing a shell 0:10-0:15
• Post-exploitation reveals a Python script with write access to the __pycache__ directory, which stores compiled Python bytecode 0:16-0:21
• The privilege escalation leverages Python's recompilation logic—it only recompiles if the source file is newer or a different size than the cached version, both of which are stored as values in the compiled file's header 0:21-0:33
The video showcases a creative two-stage attack: first weaponizing a browser extension for initial access, then manipulating Python's caching mechanism for privilege escalation.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
What's going on YouTube? This is IPSC and today we'll be doing browse from hack the box which starts off with finding a website that would test browser extensions and there's also an application listening on local host that has a command injection vulnerability. So we'll create a browser extension that would hit the website on local host to trigger the rce and give us a shell. Once on the box, we discover there's a Python script and we can write to the pi cache directory. This is where compiled Python scripts go. And on this version of Python, it will only recompile the script if the Python file is newer or a different size than the compiled file. These values are just data in the header. So the easiest way to tamper with this is to create a new Python, compile it, and then copy the header…