In this post, I would like to share a walkthrough of the Headless Machine from Hack the Box

This room will be considered an Easy machine on Hack the Box

What will you gain from the Headless machine?

For the user flag, you need to exploit a Cross-Site Scripting (XSS) vulnerability, we will capture the session cookie of the administrator user. This captured cookie will enable us to perform Remote Code Execution (RCE), allowing us to gain access to the target machine.

As for the root flag, you must exploit the syscheck script by creating a malicious file, enabling it to execute with root user permissions.

Information Gathering on Headless Machine

Once we have started the VPN connection which requires a download from Hackthebox, we can start