Cohort Writeup - HackTheBox

Easy Linux

Discuss on Discord

Created June 15, 2026 • Last updated August 17, 2026 • 6 min read

Khant-Nyar

Pentester, Learner, Builder

Joshua

HackIndex Creator

Cohort is a Linux box that hides its real attack surface behind an nginx edge and a distracting single page app. It is still active, so this page opens with the port scan and stops there.

Reconnaissance

Port scan

┌──(kali㉿kali)-[~]

└─$ nmap -sCV -p22,80,443 $TARGET_IP -oA nmap/nmap

PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.18
80/tcp  open  http     nginx 1.24.0
|_http-title: Did not follow redirect to https://cohort.htb/
443/tcp open  ssl/http nginx 1.24.0
| ssl-cert: Subject: commonName=cohort.htb
| Subject Alternative Name: DNS:cohort.htb, DNS:*.cohort.htb
|_http-title: Cohort Analytics
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Explain command

-sCV	Run the default script set and probe service versions.
-p22,80,443	Scan the three exposed ports.

Domains

Hostnames seen in the scan, from the redirect and the TLS certificate SAN:

cohort.htb
*.cohort.htb (wildcard certificate, subdomains not enumerable from the scan)

Protected Writeup

This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.