{"uuid": "4e336098-6d90-491e-9808-8b96070a85cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-5736", "type": "seen", "source": "https://t.me/hacking_Attack/27880", "content": "Hacking Articles|Raj Chandel's Blog\nTheNotebook HackTheBox Walkthrough\n\nWe\u2019ll look at another one of HackTheBox machines today, called \u201cTheNotebook.\u201d It is a medium difficulty box targeting commonly found threat of using insecure JWT token implementation. A user is able to gain access to the system by forging this token and adding desired values. We\u2019d own the root user by targeting it. Here is the methodology. Penetration Testing Methodology\u00b7 NmapExploitation\u00b7 Forging the JWT token with admin rights and self-generated private keyPrivilege Escalation\u00b7 Recovering SSH private key from an old backup directoryCVE-2019-5736)\n\n\u00b7 Gaining root accessReconMachine\u2019s IP was 10.129.211.197. The first step was to run nmap\u2019s aggressive scan to look for open ports. As you can see a port 80 was found to be open.nmap -A\u00a0 10.129.211.197https://blogger.googleusercontent.com/img/a/AVvXsEhxStGsjlqoMdg-fqQAmSSYabLKUUB9WK0xjmsnCcz4Olhw2YiFzSgatbKkR5xOP_nrszkGgwv8HwCkODldvhGafKXbu1VuEQH5r2jD9dmeM_3tdWq8mx6AkfTD4AyBjOK29y1jsozULsC75S92ZNEvnXnKX1hOBIkHxzFyWfWNA9QYQyAbHvOjkMrxoQ=s16000 The website opens up a note management tool. There was a register link too.ExploitationSo, we\u2019ll generate a private key, host it on our local server, and change the JWT header to my own key\u2019s location and try if the website fetches and authenticates using our key.openssl genrsa -out privKey.key 2048https://blogger.googleusercontent.com/img/a/AVvXsEiKERiNvpDJYi_lkt_ByiJjfSgLcDTk4f31yDqOV-xI5NycZ2Y5VPDStdO1s7owotkJQl8bczUrzbFbiETOBafn9hY-M7xqrs0B-pANDBQr3l3i3zm2FW0oS01eRW0HGJYuyRMR-Dq9ujfMwtluCI23UdUzADJrHxjhjT3vqy5VyKJMyg37fPBgfsvvFw=s16000 We\u2019d change the fields in our JWT header now and paste our own key in the field below for the token to verify the signature and successfully authenticate using my key.___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:13.239478Z"}