HTB Nimbus Complete Writeup - SSRF, IMDS Credential Theft, LocalStack Abuse & modprobe Container Escape
Nimbus is a HackTheBox Season 11 Hard Linux machine centered around a cloud-themed internal job scheduler running on Nginx. The exploitation chain begins with an unauthenticated SSRF vulnerability in the /jobs/preview endpoint, where an octal/decimal-encoded IP bypasses the metadata blocklist to reach the EC2 Instance Metadata Service (IMDS) and steal temporary credentials for the nimbus-web-role IAM role. These credentials are used to enumerate a LocalStack AWS emulator ('floci') fronted by aws.nimbus.htb, revealing an SQS nimbus-jobs queue. Malicious YAML is injected into the queue, exploiting unsafe deserialization in the worker to achieve arbitrary Python code execution inside a Docker container and exfiltrate user.txt. The critical realization that IAM authorization is only enforced at the proxy layer allows direct communication with floci:4566 using default test credentials, granting full root-level AWS access. This access is leveraged to spin up a privileged CodeBuild container, bypass the gosu privilege-drop via a BASH_FUNC_id%% environment variable override, and abuse the modprobe usermode-helper by writing a malicious script to /proc/sys/kernel/modprobe and triggering it with a bad-magic binary execution - achieving full host root and capturing root.txt.
Jul 22, 2026