# Cohort Writeup - HackTheBox

> Exploit a web app leaking user cohort data to enumerate valid credentials, then leverage misconfigured SSH access to escalate privileges on this easy Linux box.

- **URL:** https://hackindex.io/writeups/cohort
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** ssrf, privilege-escalation, suid, sudo-misconfiguration, wildcard-injection, cve-2026-39987, cve-2026-41651
- **Access:** Partly password protected
- **Authors:** [Khant-Nyar](https://hackindex.io/authors/khant-nyar.md), [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 6 min read
- **Published:** 2026-06-15
- **Updated:** 2026-08-17

Cohort is a Linux box that hides its real attack surface behind an nginx edge and a distracting single page app. It is still active, so this page opens with the port scan and stops there.

## Reconnaissance

### Port scan

```bash
nmap -sCV -p22,80,443 $TARGET_IP -oA nmap/nmap
# PORT    STATE SERVICE  VERSION
# 22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.18
# 80/tcp  open  http     nginx 1.24.0
# |_http-title: Did not follow redirect to https://cohort.htb/
# 443/tcp open  ssl/http nginx 1.24.0
# | ssl-cert: Subject: commonName=cohort.htb
# | Subject Alternative Name: DNS:cohort.htb, DNS:*.cohort.htb
# |_http-title: Cohort Analytics
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

### Domains

Hostnames seen in the scan, from the redirect and the TLS certificate SAN:

- `cohort.htb`
- `*.cohort.htb` (wildcard certificate, subdomains not enumerable from the scan)

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.