Cohort
01Why the full writeup is held back
Cohort is a live Season 11 machine, so in line with Hack The Box's guidance on active machines I am not publishing the step-by-step reproduction, the exact bypass payloads, credentials or flags. The complete walkthrough, covering the enumeration, the SSRF-to-notebook pivot, the transport trick that unlocked the RCE, the privilege-escalation path and a client-style remediation plan, goes live here once the season closes.
02The interesting bits (no spoilers)
A blocklist is not an allow-list
The URL validator rejected exactly two strings and nothing else. Every other way of writing the same loopback address walked straight through. That turned a "safety" feature into a server-side request forgery tool for mapping and reaching services bound to localhost that were never meant to face the internet.
The right vulnerability behind the wrong door
The SSRF found an internal notebook server carrying a genuine pre-auth remote code execution bug (CVE-2026-39987): one WebSocket route that forgot to check authentication and handed out an interactive shell. The catch was that the only way in — a blind, single-shot HTTP GET — physically could not perform the WebSocket handshake the exploit needed.
The certificate was the hint
The box's wildcard TLS certificate was the tell. A per-notebook dynamic hostname was proxied directly to the internal service, giving a clean, full-duplex path to the vulnerable route without the SSRF's limitations. The lesson: a wildcard cert plus a permissive reverse-proxy vhost can quietly re-expose everything you thought you had firewalled to loopback.
A patched host with one un-patched package
Privilege escalation was a study in discipline. The kernel was deliberately hardened, with sysctl and modprobe files named after specific 2026 CVEs — and every one of them checked out as patched or blocked. The real hole was a single held package: PackageKit pinned at a vulnerable build while its own libraries had been upgraded past it. A deterministic time-of-check/time-of-use flaw in its install handling (CVE-2026-41651) installed an attacker-controlled payload as root, no prompt.
03Takeaways
- Validate egress with an allow-list, after DNS resolution. Blocklisting string forms of "localhost" is not SSRF defence; resolve the host, reject internal ranges, and re-check post-resolution to beat rebinding.
- Loopback is not a security boundary. A wildcard certificate and a catch-all proxy vhost re-exposed an internal service that binding to 127.0.0.1 was supposed to protect.
- Patch the version, not just the transport. The notebook RCE was fixed upstream; running an old build behind a proxy still shipped the bug.
- Never hold a package below its own libraries. The whole root path existed because one security-relevant package was pinned while everything around it was updated.
- Straight into the day job: detection for SSRF to internal ranges, unauthenticated WebSocket shells, and partial-upgrade package states, plus an Ubuntu 24.04 STIG / CIS hardening baseline.