# Nimbus Writeup - HackTheBox

> Exploiting a cloud misconfiguration in a hard Linux HackTheBox machine involving AWS/cloud enumeration, privilege escalation through misconfigured services.

- **URL:** https://hackindex.io/writeups/nimbus
- **Platform:** HackTheBox
- **Difficulty:** Hard
- **Operating system:** Linux
- **Tags:** ssrf, deserialization, privilege-escalation, docker-escape, aws, cloud-misconfiguration
- **Access:** Partly password protected
- **Authors:** [Joshua](https://hackindex.io/authors/joshua.md)
- **Read time:** 6 min read
- **Published:** 2026-05-30
- **Updated:** 2026-07-17

## **Reconnaissance**

### **Port Scan**

```bash
nmap -sV -sC -p- -T4 $TARGET_IP
# PORT   STATE SERVICE VERSION
# 22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.16
# 80/tcp open  http    nginx 1.24.0 (Ubuntu)
# |_http-title: Did not follow redirect to http://nimbus.htb/
```

Two ports. The redirect tells us the hostname.

```bash
echo "$TARGET_IP nimbus.htb" | sudo tee -a /etc/hosts
```

> [!NOTE]
> The rest of this writeup is password protected, the platform asks to keep solutions of active machines private. Open the page in a browser to unlock it.