---
title: "HTB: Kobold"
url: https://daily.dev/posts/htb-kobold-sd3ac8uff
source_url: https://0xdf.gitlab.io/2026/08/01/htb-kobold.html
type: article
source: "0xdf hacks stuff"
published: 2026-08-01T15:03:38.023Z
updated: 2026-08-01T16:12:29.946Z
tags: ["security", "docker", "php", "mcp"]
reading_time: 29
upvotes: 1
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# HTB: Kobold

**[0xdf hacks stuff](https://daily.dev/sources/0xdf)** · 29 min read · 1 upvotes · 0 comments

## Summary

A walkthrough of the HackTheBox machine 'Kobold', which hosts MCPJam inspector, PrivateBin, and Arcane Docker management behind Nginx. Initial access is gained via CVE-2026-23744, an unauthenticated RCE in MCPJam that binds to all interfaces and allows installing an attacker-controlled MCP server. Lateral movement exploits CVE-2025-64714, a local file inclusion in PrivateBin's template-selection cookie feature, used to write and execute a PHP webshell inside the container. The container's config leaks a database password reused for Arcane. Docker panel access enables mounting the host filesystem in a new container, dropping an SSH key, and gaining root. A bonus section covers an unintended path via a misconfigured gshadow file granting ben docker group access directly.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://0xdf.gitlab.io/2026/08/01/htb-kobold.html>

## Similar posts on daily.dev

- [HTB: Orion](https://daily.dev/posts/htb-orion-p1pnwvkbh) · 0xdf hacks stuff · 0 upvotes · 0 comments
- [HTB: Cobblestone](https://daily.dev/posts/htb-cobblestone-jxhw7xtg4) · 0xdf hacks stuff · 0 upvotes · 0 comments
- [HTB: MonitorsFour](https://daily.dev/posts/htb-monitorsfour-vvzdwpysy) · 0xdf hacks stuff · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#php](https://daily.dev/tags/php), [#mcp](https://daily.dev/tags/mcp)

[View this post on daily.dev](https://daily.dev/posts/htb-kobold-sd3ac8uff)