HTB MakeSense Complete Writeup - Client-Side Crypto, Stored XSS & Root PHP Dev Server
MakeSense is a HackTheBox Season 11 Medium Linux machine centered around a WordPress site with a custom 'webagency' theme. The exploitation chain begins with enumerating a client-side voice/contact feature that encrypts data using a hardcoded JavaScript key before sending to WordPress via admin-ajax.php. An attacker can forge encrypted payloads using the exposed key, first creating a contact submission and then attaching a forged encrypted 'summary' containing a stored XSS payload. When the admin bot opens the submission in /wp-admin, the XSS executes and creates a new administrator account (svc_wp). Logging in as svc_wp allows uploading a malicious plugin ZIP for PHP code execution as www-data. The wp-config.php file leaks SSH credentials for user walter, granting a shell and user.txt. Privilege escalation comes from a root-owned PHP development server bound to 127.0.0.1:8001 running an OCR web app that saves recognized text to arbitrary filenames in its web root. By saving a PHP webshell as shell.php, full root command execution is achieved and root.txt is captured.
Jul 22, 2026