HackTheBox — Pterodactyl

Overview

Pterodactyl is a Hard-difficulty Linux machine featuring a recent XFS filesystem vulnerability and complex privilege escalation. This machine teaches:

• Advanced enumeration techniques
• Kernel/filesystem vulnerability exploitation
• Race condition exploitation
• Binary compilation for target architecture

Enumeration

Port Scanning

Initial scanning reveals multiple services including:

• SSH service
• Web application
• Additional custom services

Web Application

The web application appears to be related to system management. Key areas to investigate:

• User authentication
• File upload functionality
• System information disclosure
• API endpoints

Initial Foothold

Vulnerability Discovery

The initial access vector involves:

1. Finding exposed credentials or authentication bypass
2. Exploiting web application functionality
3. Gaining shell access through service abuse

Exploitation Hints

Consider:

• How file uploads are processed
• Whether there are default credentials
• What services are accessible after authentication

User Flag Location: /home/[username]/user.txt

Privilege Escalation

System Analysis

Once you have user access, examine:

• Kernel version and patch level
• Filesystem types in use
• Mounted filesystems and permissions
• Recent CVEs for the OS version

The Path to Root

The privilege escalation involves:

1. CVE-2025-6018/6019 - XFS filesystem vulnerability
2. Race condition exploitation
3. Creating SUID binaries through filesystem manipulation

Key Concepts

• Understanding XFS resize operations
• Race conditions in filesystem operations
• Cross-compilation vs native compilation
• Loop device manipulation

Root Flag Location: /root/root.txt

Key Takeaways

• Always check for recent CVEs matching the target OS
• Filesystem vulnerabilities can lead to privilege escalation
• Race conditions require precise timing
• Architecture matters when compiling exploits

Tools Used

• nmap - Port scanning
• gobuster - Web enumeration
• gcc - Native compilation
• dd / mkfs.xfs - Filesystem manipulation
• udisksctl - Disk management
• Custom exploit code