Inside pdftex shell:

We start with an Nmap scan to identify open ports and services. nmap -sC -sV -oA nmap/pdfy 10.10.10.x Use code with caution. Port 22/tcp (SSH): Likely for final access. Port 80/tcp (HTTP): The primary web application. Web Application Analysis (Port 80)

A logical first step for any attacker interacting with a URL parser is to check if the server allows internal system requests directly. Try submitting internal loopback paths:

You can use a or, for a more convenient solution for CTF challenges, ngrok . Ngrok creates a secure tunnel to your local machine, exposing a local web server to the public internet.

After executing the pdftex exploit:

compile

The box typically starts with a standard web server running a simple web application. The core functionality allows a user to input a URL or upload a file to generate a PDF.

Before executing any exploit, ensure your local penetration testing environment is connected securely to the Hack The Box VPN platform. PDFy Category: Web / Challenges Difficulty: Easy

This walkthrough is intended for educational and ethical security research purposes within the context of the Hack The Box platform.

: Using tools like gobuster or dirsearch , we uncover hidden directories and files.

Generate the PDF. You’ll see the contents of /etc/passwd rendered in the PDF.

Before diving into automated tools, a manual interaction is crucial. Here’s the initial thought process and the observations that set the stage for the entire engagement: