# Kobold Writeup - HackTheBox

- **URL:** https://hackindex.io/writeups/kobold
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://hacktheboxltd.sjv.io/kobold
- **Tags:** privilege-escalation, wildcard-injection
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Published:** 2026-03-31
- **Updated:** 2026-05-10

## Discovery

### Port Scan

```bash
scan_tcp_full $TARGET_IP
# PORT     STATE SERVICE  VERSION
# 22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.15
# 80/tcp   open  http     nginx 1.24.0 (Ubuntu)
# |_http-title: Did not follow redirect to https://kobold.htb/
# 443/tcp  open  ssl/http nginx 1.24.0 (Ubuntu)
# | ssl-cert: Subject: commonName=kobold.htb
# | Subject Alternative Name: DNS:kobold.htb, DNS:*.kobold.htb
# |_Not valid after: 2125-02-19T15:08:55
# 3552/tcp open  http     Golang net/http server
# |_http-title: Site doesn't have a title (text/html; charset=utf-8)
```

HTTP on port 80 redirects to `https://kobold.htb/`. The TLS certificate on port 443 covers both `kobold.htb` and `*.kobold.htb`, meaning subdomains are in scope. Add the host:

```bash
echo "$TARGET_IP kobold.htb" | sudo tee -a /etc/hosts
```

Port 3552 runs a Go HTTP server that returns a full HTML application frontend ,  not a typical API. The wildcard SAN is worth fuzzing for active vhosts once the main application is understood.

UDP returned nothing of interest across the top 200 ports.

Related

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.