# Enigma Writeup - HackTheBox

- **URL:** https://hackindex.io/writeups/enigma
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Tags:** webshell, cve-2026-38751
- **Access:** Partly password protected
- **Read time:** 4 min read
- **Published:** 2026-05-30
- **Updated:** 2026-06-28

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

## **Discovery**

TCP scan across all ports:

```bash
nmap -p- --min-rate 5000 -T4 $TARGET_IP -oA nmap-allports
nmap -sCV -p 22,80,110,143,993,995,2049 $TARGET_IP -oA nmap-services
# 22/tcp  open  ssh      OpenSSH 9.6p1 Ubuntu
# 80/tcp  open  http     nginx 1.24.0
# 110/tcp open  pop3     Dovecot pop3d
# 143/tcp open  imap     Dovecot imapd
# 993/tcp open  ssl/imap
# 995/tcp open  ssl/pop3
# 2049/tcp open  nfs_acl
```

SSH only accepts public key authentication. NFS on 2049 is worth checking before anything else.

```bash
showmount -e $TARGET_IP
# Export list for $TARGET_IP:
# /srv/nfs/onboarding *
```

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.