HTB Nimbus Complete Writeup - SSRF, IMDS Credential Theft, LocalStack Abuse & modprobe Container Escape

A comprehensive penetration testing guide exploiting an SSRF bypass via octal/decimal IP encoding to steal EC2 IMDS credentials, abusing a LocalStack AWS emulator with proxy-only IAM enforcement, injecting malicious YAML into an SQS queue for worker RCE, and escalating through a privileged CodeBuild container with a BASH_FUNC gosu bypass to achieve host root via modprobe usermode-helper abuse.

July 22, 2026 • views • 10 min read • 1,056 words

By

Havoc

hackthebox 35 htb 39 linux 17 cloud 2 aws localstack ssrf 3 server-side-request-forgery 3 imds instance-metadata-service ec2 iam credential-theft sqs yaml deserialization 2 unsafe-yaml-load rce 12 remote-code-execution 7 docker 4 container-escape privileged-container codebuild gosu-bypass bash-func modprobe usermode-helper kernel-exploit overlayfs cap-sys-admin octal-ip-bypass decimal-ip-bypass 2 blocklist-bypass 2 sqs-injection floci season11 13 hard-difficulty 6 job-scheduler nimbus-web-role worker-rce exfiltration lateral-movement 10 privilege-escalation 23 host-root