http://www.adhikariashwin0.com.np/tags/docker-escape/ Recent content in Docker Escape on the008Killer Hugo en Sun, 02 Aug 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/kobold/ Sun, 02 Aug 2026 00:00:00 +0000 http://www.adhikariashwin0.com.np/writeups/hackthebox/kobold/ <h2 id="overview">Overview</h2> <table style="width:100%; table-layout:fixed;"> <thead> <tr> <th style="width:40%; text-align:left;">Category</th> <th style="width:60%; text-align:left;">Info</th> </tr> </thead> <tbody> <tr><td>Machine Name</td><td>Kobold</td></tr> <tr><td>Difficulty</td><td>Easy</td></tr> <tr><td>Release Date</td><td>21 March, 2026</td></tr> <tr><td>Author</td><td>sau123</td></tr> <tr><td>OS</td><td>Linux</td></tr> <tr><td>Pwned Date</td><td>25 March, 2026</td></tr> </tbody> </table> <h2 id="reconnaissance">Reconnaissance</h2> <h3 id="port-scan">Port Scan</h3> <div class="highlight"><pre tabindex="0" class="chroma"><code class="language-text" data-lang="text"><span class="line"><span class="cl">22/tcp — OpenSSH 9.6p1 </span></span><span class="line"><span class="cl">80/tcp — nginx (redirects to HTTPS) </span></span><span class="line"><span class="cl">443/tcp — nginx + TLS (kobold.htb) </span></span><span class="line"><span class="cl">3552/tcp — Golang HTTP server (public) </span></span></code></pre></div><h3 id="subdomain-enumeration">Subdomain Enumeration</h3> <p>Virtual host enumeration reveals two subdomains:</p> <table> <thead> <tr> <th>Subdomain</th> <th>Service</th> </tr> </thead> <tbody> <tr> <td><code>mcp.kobold.htb</code></td> <td>MCPJam (MCP server)</td> </tr> <tr> <td><code>bin.kobold.htb</code></td> <td>PrivateBin (reverse proxied to Docker container on 127.0.0.1:8080)</td> </tr> </tbody> </table> <hr> <h2 id="what-is-mcpjam">What is MCPJam?</h2> <p>MCPJam is an open-source <strong>Model Context Protocol (MCP)</strong> server. MCP is a protocol that allows AI assistants to connect to external tools and data sources. MCPJam acts as a bridge — it accepts a configuration from a client and spawns a local process that speaks the MCP JSON-RPC protocol over stdio.</p>