Hack The Box: Nimbus Machine Walkthrough – Hard Diffuclity
Just completed the “Nimbus” machine on Hack the Box — a Hard difficulty box with a strong focus on cloud and web exploitation.
The attack path started with an unauthenticated internal job scheduler that allowed YAML-based job submissions. By abusing the job preview feature, I was able to achieve SSRF and reach the AWS Instance Metadata Service. A simple filter was bypassed using octal IP obfuscation (0251.0376.0251.0376), which led to the retrieval of temporary IAM credentials for the nimbus-web-role.
With those credentials, I gained access to an internal SQS queue running on LocalStack. From there, I delivered a reverse shell payload to a worker container and obtained a low-privileged shell (user flag).
Privilege escalation involved creating a malicious CodeBuild project that ran in privileged mode. A crafted buildspec was used to exfiltrate the root flag from the container environment.
Overall, a well-designed machine that chains web vulnerabilities with real-world AWS misconfigurations and container isolation weaknesses. Highly recommended for anyone looking to sharpen their cloud security skills.
#HackTheBox #CyberSecurity #PenetrationTesting #CloudSecurity #AWS #SSRF #CodeBuild #InfoSec #CTF #RedTeam