Touch HTB Walkthrough

I just solved Touch from Hack the Box!

Touch Machine Summary

Touch is an easy-difficulty Windows machine on Hack The Box that focuses on web application enumeration, information disclosure, insecure authentication mechanisms, credential reuse, Windows kiosk escape techniques, database credential exposure, and privilege escalation through MySQL User-Defined Functions (UDFs).

I began by performing Nmap enumeration, which revealed four open ports: RPC (135), RDP (3389), WinRM (5985), and HTTP (8443). After configuring my local hosts file to resolve touch.htb, I investigated the web application running on port 8443 and discovered a login page for Nexion DocReader DeviceHub DH-100 - Gate B7. Using ffuf for directory and endpoint enumeration, I identified the /login and /api endpoints. Further API fuzzing revealed /api/status, which was accessible without authentication and disclosed sensitive device information, including the model, firmware version, operational status, and serial number.

I exploited this information disclosure by using the exposed serial number, NX-DH-2024-B7042, as the device password. This allowed me to authenticate to the Nexion DeviceHub dashboard, where I discovered administrative controls for connected scanner and printer devices. By clicking the Show buttons beside the masked credential fields, I retrieved the username KioskUser and password K!0sk2026#. I reused these credentials to establish an RDP session on the target Windows workstation using xfreerdp.

After successfully authenticating through RDP, I was presented with the HTB Airways Self Check-in Kiosk, a restricted passenger check-in application designed to prevent users from accessing the underlying Windows desktop. I clicked Touch Screen to Begin, selected English as my preferred language, and proceeded to the Find Your Booking page. The application required a booking reference and passenger's last name to retrieve reservation information. Using the provided booking reference KS7X2M and last name CRAWFORD, I attempted to access the passenger's booking.

During the booking lookup process, I noticed that the kiosk implemented a session countdown timer. If I took too long to enter the booking details, the application displayed a "Booking not found" error, requiring me to restart the process. After entering the correct details within the allocated time, I successfully progressed to the Document Verification stage, where the application required a passport scan before allowing the check-in process to continue.

The document verification interface displayed a virtual Nexion DocReader SR-4200 passport scanner. However, clicking Scan Passport repeatedly resulted in the error "Scanner could not read your document." After several unsuccessful attempts, I returned to the Nexion DeviceHub management dashboard and navigated to the scanner settings. I used the Power Off functionality to disable the scanner, changing its operational status from ONLINE to OFFLINE.

I then returned to the HTB Airways kiosk and attempted another passport scan. This time, the application displayed a different error indicating that the Nexion DocReader SR-4200 had stopped responding, accompanied by error code SCN-ERR-4092. More importantly, the error dialog contained a clickable troubleshooting hyperlink pointing to https://support.nexionsystems.com/docreader/troubleshoot. I clicked the link, which launched Microsoft Edge outside the restricted kiosk interface. Although the browser could not load the support website because of a connectivity error, it remained accessible and provided an opportunity to escape the kiosk restrictions.

I leveraged Microsoft Edge's Ctrl + O keyboard shortcut to open the file selection dialog and browse the local Windows filesystem. I navigated to C:\Windows\System32\cmd.exe, selected the executable, and allowed the browser to save a copy to the Downloads directory. I then opened the downloaded executable through the browser's Downloads panel, successfully launching an interactive Windows Command Prompt. This technique allowed me to bypass the kiosk restrictions and obtain command-line access to the underlying operating system.

After obtaining the shell, I executed whoami, which confirmed that I was operating as KIOSK-042\KioskUser. I navigated to C:\Users\KioskUser\Desktop, enumerated its contents, and retrieved the user flag from user.txt.

To establish a more flexible session, I identified my Hack The Box VPN IP address using ip a and generated a Windows x64 Meterpreter reverse TCP payload with msfvenom. I configured a Metasploit multi-handler to listen on port 4444 and hosted the executable through a Python HTTP server on port 8000. Using the built-in Windows Certutil utility, I downloaded the payload onto the compromised workstation and executed it, successfully establishing a reverse Meterpreter session.

Through Meterpreter, I performed additional system enumeration using sysinfo and confirmed that the workstation, named KIOSK-042, was running Windows 11 24H2+ (Build 26100) on an x64 architecture. I spawned another Windows command shell and began investigating the HTB Airways application's installation files for sensitive information.

While inspecting the application's backend source code, I discovered a TypeScript database configuration file located at C:\Program Files\HTB Airways\Kiosk\packages\backend\src\database\index.ts. The file contained hardcoded fallback MySQL credentials for the kiosk_app account, allowing me to authenticate to the locally hosted htb_airways database. I queried the _htb_staff table and retrieved 32 employee records containing employee IDs, email addresses, authentication codes, roles, and account statuses. These records included operational and security-related staff roles, demonstrating another significant information exposure.

I continued with Windows privilege and group enumeration using whoami /priv and whoami /groups. The results showed that my account had limited privileges and operated at a Medium Integrity Level. However, I discovered that KioskUser belonged to the custom local Printer Administrators group, which suggested potentially interesting permissions associated with device management.

I then enumerated the contents of C:\ProgramData\HTB Airways, discovering several application maintenance files, including db-config.ini, db-sync-replica.ps1, refresh-dates.bat, and refresh-dates.sql. Although access to some configuration files was denied, I was able to read the maintenance batch script. This file exposed the MySQL root password, HTB@irw4ys_DB!2026, used to execute automated SQL maintenance operations. The associated SQL script updated flight schedules, booking timestamps, boarding times, synchronization metadata, and Nexion scanner and printer information, including resetting devices to an online state.

Using the exposed credentials, I authenticated to MySQL as root and enumerated the database accounts and privileges. I confirmed that the root account possessed both GRANT and FILE privileges. I then examined the permissions assigned to C:\MySQL\lib\plugin using icacls and discovered that Authenticated Users had Modify permissions on the MySQL plugin directory.

I exploited this insecure directory configuration by uploading the lib_mysqludf_sys_64.dll library through Meterpreter. After re-establishing a Meterpreter session, I generated an additional reverse TCP executable named sys_shell.exe and uploaded it to C:\Windows\Temp. I then registered the sys_eval() MySQL User-Defined Function using the root database account, allowing operating system commands to be executed through MySQL.

To verify the execution context, I ran SELECT sys_eval('whoami');, which returned nt authority\system. This confirmed that the MySQL service was running with SYSTEM privileges and that I had successfully achieved SYSTEM-level command execution through the registered UDF.

Finally, I used sys_eval() to execute a Windows command that read C:\Users\Administrator\Desktop\root.txt, successfully retrieving the root flag and completing the Touch machine.

Overall, Touch demonstrates how several seemingly separate security weaknesses can be chained into a complete compromise. The attack path began with unauthenticated API information disclosure, progressed through weak device authentication and exposed credentials, and led to RDP access to a restricted HTB Airways kiosk. By manipulating the scanner's operational state, I triggered an error that exposed a browser-based kiosk escape, allowing access to the underlying Windows command shell. Further enumeration uncovered hardcoded application database credentials, exposed MySQL root credentials, and insecure plugin directory permissions, ultimately enabling privilege escalation to NT AUTHORITY\SYSTEM through a MySQL UDF.

Protected Page

a

b

c

d

e

f

g

h

i

x

y

z

Keywords

Rooted Touch from HackTheBox - Season 12 HTB Walkthrough

Touch Season 12 HTB Machine Write Up

HackTheBox - Season 12 Machines Walkthrough

I just solved Touch from HackTheBox

Touch Hack the Box Writeup

Touch HTB Walkthrough

KioskUser

K!0sk2026#

NX-SR-2024-0042

NX-TP-2024-0042

Jenny Crawford

Booking code KS7X2M

KIOSK-042

Nexion DeviceHub DH-100

Touch HTB Writeup

Touch HTB Nexion DeviceHub DH-100

NX-DH-2024-B7042

HACK THE BOX / SEASON 12 AERO WRITEUPS

Pwned Touch from Hack the Box

Layover HTB Writeup

Layover HTB Walkthrough

Layover HTB Root Flag

HackTheBox - Layover HTB Machine User Flag Hint

HTB Airways

HTB Writeup - Scaffold

Layover Hack the Box Write Up

Layover Hack the Box Walkthrough

HTB BlockSynergy Complete Writeup - Blockchain PoW Mining

I just solved Layover from Hack the Box

contractor layover credentials

Scaffold Walkthrough: Beginner's Writeup from Hack The Box

Contractor2026! Layover HTB Machine Credentials

HackTheBox - Layover HTB Season 12 Contractor2026! credentials Walkthrough

BlockSynergy HTB Writeup - Insane Linux Box Walkthrough

Touch HTB Walkthrough Complete HackTheBox Season 12 Machine Writeup

boltech has successfully pwned Touch Machine from Hack The Box

Scaffold Writeup - HackTheBox

HTB Scaffold Complete Writeup

Writeup HTB Walkthrough | Season 11 HackTheBox CTF  Machine Solutions

Scaffold HTB - Complete Writeup

Hack The Box Scaffold Stats (Hard Windows)

HTB DanglingTree Writeup - Medium (Hack The Box)

GitHub HackTheBox-Writeups-Walkthroughs: HTB Season 11 Season 12 Aero

GitHub HTB-writeups: Writeups of solved HTB Season 12 labs