HTB: Developer Writeup

#htb #writeup #linux

Developer — HackTheBox Writeup

MachineDeveloper
OSLinux
DifficultyHard
Rating⭐⭐⭐⭐☆
Authord3vn0mi

🛠️ Walkthrough

Both flags have been captured successfully:

  • user.txt (karl): <redacted>
  • root.txt: <redacted>

Full chain executed per the write-up’s intended path:

  1. Solved the “PwnMe” reversing challenge to unlock writeup submission
  2. Reverse-tabnabbing + XSS phishing attack captured admin’s real credentials (admin:SuperSecurePassword@HTB2021)
  3. Django admin panel revealed the developer-sentry.developer.htb subdomain and admin’s real identity (Jacob)
  4. Found Sentry’s legacy (non-API) project-removal view leaks the Django SECRET_KEY via an uncaught exception’s local variables
  5. Forged a malicious pickled sentrysid session cookie (hand-rolled django.core.signing in pure Python — hit and fixed a subtle base62-alphabet-ordering bug) for RCE as www-data
  6. Pulled Postgres creds from sentry.conf.py, dumped karl’s password hash from auth_user, cracked it with hashcat → SSH as karl (user.txt)
  7. Reversed the Rust authenticator binary to extract a hardcoded AES-128-CTR key/IV/ciphertext, decrypted it to recover the sudo-gated tool’s password
  8. Used the authenticator to install our SSH key for root → root.txt

Details and gotchas are saved in /out/solve_out_20260722_192118/flags.md and the plan in attack_plan.md.

🏁 Proof of Ownership

FlagValue
User<redacted>
Root<redacted>