~/louizi
HackTheBoxHard

HTB: Nimbus

Enumeration notes only — this box is still active on HackTheBox, so the exploit chain stays unpublished until it retires. Recon points at a cloud-native, container/AWS-emulation themed target.

Cloud character raining padlock-key icons inside a red ring badge

Status: Active machine — HTB’s rules disallow publishing writeups for boxes that haven’t retired yet. This post covers enumeration only; the full exploit chain will be added once Nimbus retires.

Recon

sudo nmap -A -p- -Pn -n -T4 -vv -oN nmap.txt 10.129.69.9
PORT   STATE SERVICE REASON         VERSION
22/tcp open  ssh     syn-ack ttl 63 OpenSSH 9.6p1 Ubuntu 3ubuntu13.16 (Ubuntu Linux; protocol 2.0)
80/tcp open  http    syn-ack ttl 63 nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Did not follow redirect to http://nimbus.htb/

Added nimbus.htb to /etc/hosts.

Directory + Vhost Fuzzing

http://nimbus.htb/FUZZ
/login
/jobs
/jobs/preview
/api/v1/health
ffuf -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -H "Host: FUZZ.nimbus.htb" -u http://nimbus.htb/

Only one vhost found: aws.nimbus.htb.

More to come once the box retires.