Source: Ippsec

HackTheBox - Cobblestone

By Ippsec1 min readAugust 15, 2026

Internal Read means the full piece stays on Qubicweb, with its source path and context still visible.

Brief points

00:00 - Introduction 01:00 - Start of nmap 03:00 - Creating an account on the main domain and discovering it doesn't create one on vote 05:30 - Discovering a SQL Injection when...

00:00 - Introduction 01:00 - Start of nmap 03:00 - Creating an account on the main domain and discovering it doesn't create one on vote 05:30 - Discovering a SQL Injection when suggesting URL's on the vote application, converting it to Union Injection and showing SQLMap 10:15 - Union injection working, getting the payload over to SQLMAP so we can have it dump the database while we look at other things 15:30 - Going back to the Skin Suggestor, discovering XSS 17:50 - Having the XSS Send us back the page the victim is on, discovering a debug page is linked which contains PHPINFO 23:15 - The PHPINFO output reflects the PHP Cookie, creating a CSRF Payload to have the victim navigate to the PHPINFO page and send us the output to steal their cookies even thoe they are marked HTTPONLY 28:15 - Discovering SSTI, this is PHP so using a PHP TWIG Payload to get RCE, some commands fail discovering it is apparmor 35:15 - Failing to get a reverse shell for a while 41:08 - Using MySQL Dump to dump the database, the SQL injection didn't get this because its a different DB 45:50 - Shell returned as Cobblestone 51:00 - Discovering Cobbler is running, forward the post back to us, use XMLRPC to get RCE (a 2014 GitHub issue) 54:20 - Having Claude look at the issue and try to make a POC while we poke at it manually 58:48 - Proving we can bypass auth with -1 as the password, and getting shell