Windows

Hack The Box - HTB Touch Writeup - Easy - Weekly - october 3th, 2026

October 3, 2026

Overview Target IP: 10.129.xx.xx Attacker (VPN) IP: 10.10.xx.xx Supplied credentials: Jenny Crawford / KS7X2M The box is themed around a fictional airline check-in kiosk ("HTB Airways"). The attack surface combines a device-management web portal (Nexion DeviceHub), a tightly restricted Windows kiosk session, and a locally running MySQL 8.0 instance that is ultimately turned into SYSTEM-level code execution through a User Defined Function (UDF). 1. Reconnaissance — Nmap nmap -sV -sC 10.129.xx.xx Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-04 02:03 +0000 Nmap scan report for 10.129…