MakeSense
01Why the full writeup is held back
MakeSense is a live Season 11 machine. In line with Hack The Box's guidance on active machines, I don't publish a step-by-step reproduction while it's still in play. The complete writeup — recon, foothold, the CVE red-herring, the file-write-to-root vector, and remediation — goes live here once the season closes.
02The interesting bit (no spoilers)
A CVE that looked like the answer — and wasn't
A service on the box matched a recently disclosed, high-severity local privilege-escalation CVE.
It looked like the intended path, so I invested time building and tuning an exploit. The catch: the
vendor's fix had been silently backported into the distro package without a version
bump — --version reported "vulnerable" while the changelog said otherwise. A good reminder
that a version string is a claim, not proof.
The bug that actually worked
Root came from a custom internal tool with a file-write flaw — an ordinary access-control gap letting an unprivileged user drop a file where a root process would act on it. The "boring" class of bug (file writes, path handling, service trust boundaries) doing what boring bugs do best.
03Takeaways
- A CVE with a high CVSS and a catchy name isn't automatically the answer — verify the target is actually vulnerable before building around it.
- Silent, backported fixes mean version numbers lie. Confirm with behaviour, not the changelog.
- Access-control gaps and file-write bugs still account for a huge share of real-world privesc — worth as much attention as the flashy CVEs.
- These are the same failure modes I chase from the defensive side day-to-day — which is exactly why I run the offensive labs.