---
# System prepended metadata

title: HTB Traverxec walkthrough

---

# HTB Traverxec walkthrough

### Scan with nmap
![](https://i.imgur.com/zecqUfm.png)
### Found out open web (80) port and 22 (ssh) port
### Also found out a vulnerable nostromo web service (v 1.9.6)
### 
### Using MSF exploit - got shell on the machine 
```
use exploit/multi/http/nostromo_code_exec
```
### Spawned bash shell
```
python -c 'import pty; pty.spawn("/bin/bash")'
```
![](https://i.imgur.com/KSZKF1i.png)
### Using linpeas I discovered a ssh private key of David that my teammate left in the /tmp folder
![](https://i.imgur.com/lvrbOR9.png)
### Cracked ssh using john
![](https://i.imgur.com/hLYEauN.png)
### And then logged in as David
![](https://i.imgur.com/8I1gRgL.png)
### Searched again with linpeas for SUID bit files. For some reason foud nothing. But found that info in the script. Using that info of SUID bit for journalctl + jtfobins - escalated my privileges to root.
![](https://i.imgur.com/BmS435n.png)
