HTB Slonik

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/02/12/htb-slonik.html
• Blog Title: HTB: Slonik
• Suggested Section: Network Services Pentesting -> 2049 - Pentesting NFS (export escape/no_subtree_check + UID spoofing) and 22 - Pentesting SSH/SFTP (port-forwarding to UNIX sockets); plus 5432 - Pentesting PostgreSQL (COPY FROM/TO PROGRAM for OS command execution) and Linux Privilege Escalation (backup/cron privileged copy -> SUID planting)

🎯 Content Summary

Title/Context: HackTheBox “Slonik” (Linux, Medium; Release Date: 14 Oct 2025). The chain combines: (1) insecure NFS exports that allow “root filesystem escape” reads, (2) credential recovery by reading /etc/shadow and user history files via NFS + UID spoofing, (3) SSH port-forwarding to a remote PostgreSQL UNIX domain socket even when the account has /bin/false, (4) PostgreSQL OS command execution via COPY ... FROM PROGRAM, and (5) root escala...

🔧 Technical Details

NFS “root filesystem escape” via export options: If NFS exports use no_subtree_check, some clients/tools can traverse outside the exported subtree boundary and access arbitrary filesystem paths (read-only if the export is ro). Tools like NetExec can automate this with --ls / and --get-file to enumerate and download sensitive paths such as /etc/passwd and /etc/shadow. root_squash prevents acting as UID 0, but doesn’t prevent broad non-root file exfiltration.

NFS UID spoofing for file access: NFS access control relies on numeric UID/GID values from the client. If remote files are owned by UID 1337, executing local commands as UID 1337 (e.g., sudo -u '#1337' cat /mnt/service/.bash_history) can bypass local username-based expectations and read otherwise inaccessible home-directory files, enabling theft of histories, credentials, and socket paths.

SSH local...

🤖 Agent Actions

Updated linux-hardening/privilege-escalation/README.md with a new cron-privesc subsection covering pg_basebackup/root backup workflows that preserve attacker-set SUID/SGID bits, including discovery steps (pspy), exploitation commands, and rationale, and added the HTB Slonik blog to References.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/02/12/htb-slonik.html

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting -> 2049 - Pentesting NFS (export escape/no_subtree_check + UID spoofing) and 22 - Pentesting SSH/SFTP (port-forwarding to UNIX sockets); plus 5432 - Pentesting PostgreSQL (COPY FROM/TO PROGRAM for OS command execution) and Linux Privilege Escalation (backup/cron privileged copy -> SUID planting)".

Repository Maintenance:

• MD Files Formatting: 944 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0