Kobold Writeup - HackTheBox
Easy
Linux
Discovery
Port Scan
┌──(kali㉿kali)-[~]
└─$ scan_tcp_full $TARGET_IP
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 80/tcp open http nginx 1.24.0 (Ubuntu) |_http-title: Did not follow redirect to https://kobold.htb/ 443/tcp open ssl/http nginx 1.24.0 (Ubuntu) | ssl-cert: Subject: commonName=kobold.htb | Subject Alternative Name: DNS:kobold.htb, DNS:*.kobold.htb |_Not valid after: 2125-02-19T15:08:55 3552/tcp open http Golang net/http server |_http-title: Site doesn't have a title (text/html; charset=utf-8)
HTTP on port 80 redirects to https://kobold.htb/. The TLS certificate on port 443 covers both kobold.htb and *.kobold.htb, meaning subdomains are in scope. Add the host:
┌──(kali㉿kali)-[~]
└─$ echo "$TARGET_IP kobold.htb" | sudo tee -a /etc/hosts
Port 3552 runs a Go HTTP server that returns a full HTML application frontend — not a typical API. The wildcard SAN is worth fuzzing for active vhosts once the main application is understood.
UDP returned nothing of interest across the top 200 ports.
Protected Writeup
This has not retired yet on HackTheBox. We only publish writeups for retired machines and challenges. Once it retires, this writeup will become publicly accessible.