Photobomb is a Linux base machine from HackTheBox that required your patience in web application knowledge with command injection techniques and the Linux basic concept of sudo is required on the privilege escalation. It is a basic OSCP-like Box.
Command Injection was found on a download function of this web application, which can help to gain initial access. Linpeas show you there is a problem on a sudo job.
Target Machine:
Attacker Machine:

Hacking Process Part 0 – Service Scanning


  1. 1.
    nmap -p- -T5 --min-rate=1000 -oG fkclai.nmap
  2. 2.
    nmap -p $(grep -Eo '[0-9]{1,5}/open' fkclai.nmap | cut -d '/' -f 1 | tr -s '\n' ',') -sC -sV -o nmap-result.txt

Enumeration Strategies

No vulnerability was found on the SSH and HTTP service, it was going to review the web application to check for any information leakage or misconfiguration.

Hacking Process Part 1 – Enumeration

With basic web enumeration, a password was found on a JS file that can log on to an image download function. This download function has a command injection problem.

Possible Command Injection

Command Injection was found on the image download function, the Netcat command can have a response.
the reverse shell does not obtain using netcat reverse shell.

Hacking Process Part 2 – Gaining Foothold

After several tries using the payload on the reverse shell generator, the payload in Python format can be used to obtain the reverse shell.
** Remember to use the HTML parameters format

Hacking Process Part 3 – Privilege Escalation