# Management Writeup - HackTheBox

> Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.

- **URL:** https://hackindex.io/writeups/management
- **Platform:** HackTheBox
- **Difficulty:** Easy
- **Operating system:** Linux
- **Machine:** https://app.hackthebox.com/machines/Management?sort_by=created_at&sort_type=desc
- **Tags:** deserialization, rce, wordpress, dns-zone-transfer, privilege-escalation, sudo-misconfiguration, wildcard-injection, cve-2026-33439
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 3 min read
- **Published:** 2026-09-08
- **Updated:** 2026-09-13

```bash
nmap -sC -sV $TARGET_IP
# PORT      STATE SERVICE     VERSION
# 22/tcp    open  ssh         OpenSSH 9.6p1 Ubuntu 3ubuntu13.19
# 80/tcp    open  http        nginx 1.24.0 (Ubuntu)
# |_http-title: Did not follow redirect to https://management.htb/
# 443/tcp   open  ssl/http    nginx 1.24.0 (Ubuntu)
# | ssl-cert: Subject: commonName=management.htb
# | Subject Alternative Name: DNS:management.htb, DNS:*.management.htb
# 4444/tcp  open  ssl/krb524?
# | ssl-cert: Subject: commonName=sso.management.htb
# 50389/tcp open  ldap        (Anonymous bind OK)
# Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
```

Would you like to solve this machine together? Join our discord and/or our [open HTB team!](https://app.hackthebox.com/public/teams/8368)

Domain: **management.htb**, **sso.management.htb**

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.