[Protected] Imagery HackTheBox Writeup
[Protected] Imagery HackTheBox Writeup
October 11, 2025

Nmap Scan
Starting Nmap 7.97 ( https://nmap.org ) at 2025-10-11 12:36 +0200
Nmap scan report for 10.10.11.88
Host is up (0.025s latency).
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 9.7p1 Ubuntu 7ubuntu4.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 35:94:fb:70:36:1a:26:3c:a8:3c:5a:5a:e4:fb:8c:18 (ECDSA)
|_ 256 c2:52:7c:42:61:ce:97:9d:12:d5:01:1c:ba:68:0f:fa (ED25519)
8000/tcp open http Werkzeug httpd 3.1.3 (Python 3.12.7)
|_http-title: Image Gallery
|_http-server-header: Werkzeug/3.1.3 Python/3.12.7
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 9.93 secondsEnter the Password to Unlock Content
Where can I find the password?
For Linux CTF machines, retrieve the root password hash from the /etc/shadow file.
- Access the file:
cat /etc/shadow(requires root privileges). - Example:
root:$y$j9T$Vy...Gp9B:20286:0:99999:7:::
For Windows CTF machines, retrieve Administrator NT Hash from NTDS.DIT if it's a Domain Controller otherwise retrieve the local Administrator NT hash from the SAM database.
- Use
secretsdump.pyfrom Impacket orhashdumpin Meterpreter (requires administrative privileges). - Example:
Administrator:500:aad3b435b...d3b435b51404ee:0b133be956...701affddec:::
Last updated on