Nimbus HTB
Nimbus is a hard Linux machine about cloud security. A web application feature becomes a window into an AWS environment, and the rest of the box is about cloud identities, managed services and the permissions that connect them. Nimbus (nimbus.htb) is a hard-difficulty Linux machine with only SSH and a web application exposed, but the real target is the cloud environment behind it. The application lets users submit jobs for processing, and how it handles those jobs is the thread that leads everywhere else. The box is an excellent introduction to AWS attack paths: how cloud instances obtain credentials, how to enumerate what an IAM identity is allowed to do, and how message queues and build services turn into execution paths when permissions are too broad. Skills practiced: server-side request testing and filter bypasses, the AWS CLI, IAM permission enumeration, Amazon SQS, AWS CodeBuild, and thinking about privilege escalation in cloud terms rather than purely Linux terms. The full step-by-step walkthrough unlocks on this page as soon as the machine retires. This writeup is currently locked because the machine is still active on the Hack The Box platform. As per HTB policy, public writeups for active machines are not allowed. To avoid policy violations and potential account restrictions, this writeup will remain locked until the machine is retired. Once retired, the full writeup will be automatically unlocked and made available.
Difficulty: Hard · OS: linux · Category: HTB