> For the complete documentation index, see [llms.txt](https://docs.wehost.co.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.wehost.co.in/ctf-walkthrough/htb-traverxec-from-rce-to-root-with-a-nostalgic-bang.md).
# HTB: Traverxec – From RCE to Root with a Nostalgic Bang
{% hint style="info" %}
**“Give me 3 minutes and I’ll show you how a misconfigured web server handed me SSH keys on a silver platter.”**
{% endhint %}
### 🧠 Reconnaissance
We kick things off with a good old `nmap` scan:
```
nmap -Pn -A -p- 10.10.10.165
```
```
22/tcp open ssh OpenSSH 7.9p1 Debian
80/tcp open http nostromo 1.9.6
```
### 🚀 Initial Foothold – CVE-2019-16278
A quick search reveals [CVE-2019-16278](https://github.com/AnubisSec/CVE-2019-16278), a remote code execution vulnerability in `nostromo 1.9.6`.
I used a simple Python script to exploit it and got a remote shell as `www-data`.
```
python nostroSploit.py 10.10.10.165 80 "id"
```
### 🛠️ Post-Exploitation – Looting Configs
Once inside, I poked around
* Quick Google and `nostromo` has conf stored in `/var/nostromo/conf/nhttpd.conf`
```
serverroot /var/nostromo
homedirs /home
homedirs_public public_www
```
That `public_www` bit? Jackpot.
I couldn't list `/home/david` directly due to `drwx--x--x` permissions, but `/home/david/public_www` was accessible.
* this is cause of the permission i have on the dir
* On David's home dir, i have `drwx--x--x` in order for me to read the content of the directory i need read permission, which would mean `drwx--xr-x`
Inside, I found a zipped SSH key bundle. Extracted it, and then:
```
ssh -o IdentitiesOnly=yes -i id_rsa david@10.10.10.165
```
* crack the password with john
*
```
```
### 🧗 Privilege Escalation – From David to Root
As `david`, I spotted a custom script directory in his home: `/home/david/bin/`.
#### ⚔️ The Root Strike
`journalctl` can spawn a shell by executing:
And with that…\
**Root. Owned. Game over.**
