HTB Cohort Writeup

Machine profile

Platform

Hack The Box

Machine

Cohort

Difficulty

Easy

Published

2026-08-04

Status

active

Cohort is an easy-difficulty Linux machine from Hack The Box that moves from a web application weakness to a local privilege escalation, and it is one of the shortest complete chains on this site.

The skill areas are server-side request forgery and filter bypass, interactive development services exposed to the network, and Linux privilege escalation through the desktop package manager. Two ideas carry most of the weight: that a blocklist which only matches one literal string is not a security control, and that modern package managers are a privileged process worth understanding.

Cohort suits readers who want to practise filter bypass, network-exposed development tooling, and contemporary Linux escalation in a compact and readable machine. It is short enough to complete in one sitting, and structured so that each stage only becomes possible once the previous one is understood.

What this machine covers

What the finished writeup contains

When Cohort retires, the complete walkthrough publishes here unchanged — every command, output and screenshot from the actual box, in the order it was solved.

1. Reconnaissance Port scanning, service fingerprinting and attack-surface mapping
2. Initial foothold The first authenticated or unauthenticated execution path
3. Enumeration Deeper inspection of the exposed services and their configuration
4. Exploitation Chaining the weaknesses found into a working exploit
5. Credential recovery Secrets, keys and hashes, and how they were obtained
6. Privilege escalation The route from the foothold account to a root shell
7. Flags User and root flag capture