[HTB Blog] Exploiting Looney Tunables

I wrote a blog post for the HackTheBox blog, Exploiting the Looney Tunables Vulnerability on HTB (CVE-2023-4911). In the post, I’ll give an overview of the vulnerability and how exploitation works (at a high level), and then show how to run one of the proof of concept (POC) exploits against the HackTheBox TwoMillion machine. I’ll also look at how to detect Looney Tunables exploitation in Linux log files.

To try it on TwoMillion without reading the walkthrough, the follow creds will work for SSH access:

• Username: admin
• Password: SuperDuperPass123

There are also three new Guided Mode questions at the end of the box regarding Looney Tunables. You can use these questions whether you’ve completed TwoMillion or not.

The full blog post is here.