HTB-Pterodactyl

Mon, 18 May 2026 00:00:00 +0000

🛠 Overview

Category	Info
Machine Name	Pterodactyl
Difficulty	Medium
Release Date	7 Feb 2026
Author	Headmonitor & TheCyberGeek
OS	Linux
Pwned Date	10 Feb 2026

1. Reconnaissance

Nmap Scan:

PORT     STATE  SERVICE    VERSION
22/tcp   open   ssh        OpenSSH 9.6 (protocol 2.0)
| ssh-hostkey: 
|   256 a3:74:1e:a3:ad:02:14:01:00:e6:ab:b4:18:84:16:e0 (ECDSA)
|_  256 65:c8:33:17:7a:d6:52:3d:63:c3:e4:a9:60:64:2d:cc (ED25519)
80/tcp   open   http       nginx 1.21.5
|_http-server-header: nginx/1.21.5
|_http-title: Did not follow redirect to http://pterodactyl.htb/
443/tcp  closed https
8080/tcp closed http-proxy

Scanning for the subdomains we get panel.pterodactyl.htb

$ ffuf -u http://pterodactyl.htb -H "Host:FUZZ.pterodactyl.htb"  -w /usr/share/wordlists/amass/bitquark_subdomains_top100K.txt -t 200 -fs 145

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://pterodactyl.htb
 :: Wordlist         : FUZZ: /usr/share/wordlists/amass/bitquark_subdomains_top100K.txt
 :: Header           : Host: FUZZ.pterodactyl.htb
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 200
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
 :: Filter           : Response size: 145
________________________________________________

panel                   [Status: 200, Size: 1897, Words: 490, Lines: 36, Duration: 415ms]
:: Progress: [100000/100000] :: Job [1/1] :: 675 req/sec :: Duration: [0:01:55] :: Errors: 0 ::

Add the IP to /etc/hosts as well as the subdomain

CVE-2025-6018 on the008Killer

HTB-Pterodactyl

🛠 Overview

1. Reconnaissance

Nmap Scan: