--- title: HTB: Barrier | daily.dev description: A detailed walkthrough of the HackTheBox 'Barrier' Linux machine involving multiple chained vulnerabilities. The attack path starts with exploiting... canonical: https://daily.dev/posts/htb-barrier-5m5e3sa5g twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: HTB: Barrier | daily.dev og:description: A detailed walkthrough of the HackTheBox 'Barrier' Linux machine involving multiple chained vulnerabilities. The attack path starts with exploiting... og:url: https://daily.dev/posts/htb-barrier-5m5e3sa5g og:image: https://api.daily.dev/og/posts/5M5e3Sa5G.png og:image:alt: HTB: Barrier og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # HTB: Barrier **[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 24 min read · 0 upvotes · 0 comments ## Summary A detailed walkthrough of the HackTheBox 'Barrier' Linux machine involving multiple chained vulnerabilities. The attack path starts with exploiting CVE-2024-45409, a SAML signature bypass in GitLab's Ruby SAML library, to forge a SAML assertion and gain admin access to GitLab. From there, an Authentik API token stored in GitLab CI/CD variables is used to create an admin account in Authentik. With Authentik admin access, user impersonation in Apache Guacamole yields an SSH shell as user 'maki'. Database credentials from Guacamole's MariaDB backend expose an SSH private key and passphrase for another user, whose bash history contains a password enabling sudo to root. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [HTB — Strutted Writeup: Linux Machine](https://daily.dev/posts/htb-strutted-writeup-linux-machine-x6cn8azui) · InfoSec Write-ups · 1 upvotes · 0 comments - [HTB: Guardian](https://daily.dev/posts/htb-guardian-tkykgwaky) · 0xdf hacks stuff · 1 upvotes · 0 comments - [HTB: CodeTwo](https://daily.dev/posts/htb-codetwo-klj991bhn) · 0xdf hacks stuff · 2 upvotes · 0 comments - [CodePartTwo HTB Walkthrough](https://daily.dev/posts/codeparttwo-htb-walkthrough-gzwjbhyde) · InfoSec Write-ups · 1 upvotes · 0 comments - [HTB: Facts](https://daily.dev/posts/htb-facts-09nlopse0) · 0xdf hacks stuff · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#gitlab](https://daily.dev/tags/gitlab) [View this post on daily.dev](https://daily.dev/posts/htb-barrier-5m5e3sa5g) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"HTB: Barrier","url":"https://daily.dev/posts/htb-barrier-5m5e3sa5g","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/htb-barrier-5m5e3sa5g"},"datePublished":"2026-03-03T10:21:23.596Z","dateModified":"2026-03-03T10:21:49.637Z","description":"A detailed walkthrough of the HackTheBox 'Barrier' Linux machine involving multiple chained vulnerabilities. The attack path starts with exploiting...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e879032acac584d52137b1bb18047cfc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e879032acac584d52137b1bb18047cfc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"0xdf hacks stuff","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"0xdf hacks stuff","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/16cdada70d5f4fac8b588c53bcf005ff","url":"https://daily.dev/sources/0xdf"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/htb-barrier-5m5e3sa5g","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,gitlab","timeRequired":"PT24M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"0xdf hacks stuff","item":"https://daily.dev/sources/0xdf"},{"@type":"ListItem","position":3,"name":"HTB: Barrier"}]} ```