Kobold

Table of Contents

• Enumeration
• Initial Access — MCPJam RCE (CVE-2026-23744)
• User Flag
• Privilege Escalation — PrivateBin LFI (CVE-2025-49596)
• Credential Extraction & Arcane Login
• Root Flag — Docker Escape via Arcane API
• Alternative Path — sg docker
• CVE Summary
• Key Lessons
• Tools Used
• Flags

Enumeration

Port Scan

rustscan -a 10.129.11.231 --ulimit 1000 -r 1-65535 -- -A -sC -Pn

PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 9.6p1 Ubuntu 3ubuntu13.15
80/tcp   open  http     nginx 1.24.0 (Ubuntu)
443/tcp  open  ssl/http nginx 1.24.0 (Ubuntu)
3552/tcp open  http     Golang net/http server

Key observations:

• Port 80/443 redirects to https://kobold.htb/
• Port 3552 runs Arcane — a self-hosted Docker and Compose management platform (v1.13.0)
• SSL cert has DNS:kobold.htb, DNS:*.kobold.htb — wildcard subdomain, worth fuzzing

Add Hostnames

echo "10.129.11.231  kobold.htb mcp.kobold.htb bin.kobold.htb" | sudo tee -a /etc/hosts

Subdomain Enumeration

gobuster vhost -u https://kobold.htb --append-domain \
  -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-20000.txt \
  -t 50 -k

mcp.kobold.htb  Status: 200 [Size: 466]
bin.kobold.htb  Status: 200 [Size: 24402]

Service Summary