ledksv/pterodactylHackTheBox Pterodactyl walkthrough chaining CVE-2025-49132 path traversal, hash cracking, and CVE-2025-6018/6019 PAM and XFS race for root.
Platform: HackTheBox | OS: Linux
Pterodactyl Panel exposed on a subdomain. CVE-2025-49132 path traversal leaks the Laravel app key and database credentials unauthenticated — cracking the extracted hash gives SSH access. Privilege escalation chains CVE-2025-6018 (PAM environment poisoning to fake a graphical polkit session) with CVE-2025-6019 (XFS resize race condition to land a SUID shell as root).
VHost enumeration found a Pterodactyl Panel instance. Added panel.pterodactyl.htb to /etc/hosts.
CVE-2025-49132 is an unauthenticated path traversal in Pterodactyl Panel. Reading /api/client/../../../../.env leaks the Laravel app key and database connection string.
curl -s http://panel.pterodactyl.htb/api/client/../../../../.env
Used the leaked DB credentials to dump a password hash via MySQL, then cracked it with hashcat for SSH access.
CVE-2025-6018 poisons PAM environment variables to make polkit believe the calling session is graphical (X11/Wayland), bypassing the console-only restriction. This allows a local user to authenticate arbitrary high-privilege actions through polkit without being physically at a console.
CVE-2025-6019 exploits a race condition in the XFS filesystem resize path. With the PAM session bypassed via CVE-2025-6018, triggered an XFS extent allocation race that writes a root-owned SUID shell binary to disk.
/tmp/.suid_bash -p
# euid=0(root)
Root flag at /root/root.txt.
For educational purposes only. Only test systems you own or have explicit permission to test.