Beginner’s Guide to Conquering Touch on Hack the Box

Key Highlights

• Touch is an easy Windows machine on Hack The Box
• This writeup shows how the touch command becomes the key weakness on the target machine.
• The path starts with recon, including open ports, shell limits, and basic environment checks related to a controlling terminal.
• Privilege escalation depends on umask changes, arbitrary file creation, and writable root-owned files.
• Each step stays beginner friendly and explains the main techniques used in Touch.

Introduction

Touch is a good beginner machine because it teaches you to look past the obvious and study how Linux handles user permissions. From your attack machine, you are not breaking the touch command itself. You are studying the challenge classification through system behavior, SUID rules, and file creation logic. Compared with harder Hack The Box targets, this one is easier to follow, but it still rewards careful thinking and solid observation.

ALSO READ: Layover Walkthrough: Beginner’s Writeup from Hack The Box

Quick Overview of Touch Hack The Box

The name of this challenge is Touch, and it is best described as a classic challenge built around Linux permissions. The key idea is not to abuse normal touch features to create a new empty file, but to understand what happens when the touch binary runs with elevated rights. The twist being it’s a Windows machine.

What matters most are the binary permissions, the setuid bit, and the group owner values shown by listing the new files of permissions. That design pushes you to inspect how files are created, who owns them, and why those details open the way to root.

Initial Foothold

The initial foothold begins with basic service enumeration. A full TCP scan reveals several Windows services, including RDP, WinRM, MSRPC, and an HTTP service running on TCP 8443. While the other services are worth noting, the web service immediately stands out because its title identifies it as the Nexion DeviceHub management portal. Pasted text

At this stage, resist the temptation to immediately attack RDP or WinRM. Those services become much more interesting once you have valid credentials. The management portal on port 8443 is the more promising starting point.

A good next step is to perform some basic web enumeration against the application. Look for common directories, API endpoints, JavaScript files, and anything that appears to expose functionality without requiring authentication.

One particularly interesting discovery is an API endpoint that can be accessed without an authenticated session. The endpoint appears to be intended simply for reporting the status of the connected DeviceHub hardware, but the response contains more information than you might initially expect. Pasted text

This is a useful lesson when approaching unfamiliar web applications: don’t only look for obvious vulnerabilities. Read the API responses carefully. Information such as firmware versions, device identifiers, serial numbers, hostnames, or other metadata can become valuable later in an attack.

The information returned by the DeviceHub status endpoint provides an important clue about how the application is configured. Think about how embedded devices and vendor management interfaces are commonly deployed. Factory credentials, default passwords, and credentials derived from device identifiers are all worth testing when you encounter this type of application.

Once you identify the relationship between the exposed device information and the portal’s authentication mechanism, you should be able to access the DeviceHub dashboard. At this point, the attack surface changes considerably because you now have access to functionality that was not available from the unauthenticated interface. Pasted text

However, the dashboard itself is not the final objective. Spend some time inspecting how the page handles the credentials displayed for the connected devices.

The dashboard contains device cards with information such as the device name, serial number, firmware, connection status, and credential fields. There is also a small “show” control next to the masked password. Pasted text

This is where browser-side inspection becomes important.

A common mistake is to assume that clicking a “show password” button causes the browser to make an authenticated request to retrieve the password. In poorly designed applications, however, the password may already have been delivered to the browser and simply hidden from view using HTML, CSS, or JavaScript.

Inspect the page source and the JavaScript associated with the credential controls. Look specifically for:

• onclick handlers
• JavaScript functions responsible for revealing credentials
• hardcoded strings
• variables containing usernames or passwords
• hidden HTML attributes
• API calls made when the show button is clicked

The important clue is that the application does not properly protect the credential once the dashboard has loaded. The secret is present in the client-side content itself. Pasted text

At this point, you should have a set of credentials that appear to belong to a local Windows user rather than merely being application-level booking credentials.

That distinction matters.

The machine exposes both RDP on 3389 and WinRM on 5985, so it is natural to test the newly discovered credentials against the available remote-access services. The writeup confirms that the intended interactive route is RDP, while some other credentials encountered during enumeration are application-specific and do not provide a Windows session. Pasted text

Once you successfully authenticate through RDP, you have reached the machine as a low-privileged kiosk user. The desktop will not look like a normal Windows workstation. Instead, you are placed inside a fullscreen airport self-service application with the usual Windows desktop experience hidden from view. Pasted text

That is where the initial foothold ends.

The important chain to identify is:

TCP/8443
    ↓
Nexion DeviceHub
    ↓
Unauthenticated API enumeration
    ↓
Device information disclosure
    ↓
Weak/default authentication
    ↓
DeviceHub dashboard
    ↓
Inspect client-side JavaScript
    ↓
Windows credentials exposed
    ↓
RDP
    ↓
KioskUser foothold

Hint: If you’re stuck before RDP, focus almost entirely on 8443. If you already have the DeviceHub dashboard, stop looking for another exploit and inspect what the browser has actually been given.

Protected Area

This content is password-protected. Please verify with a password to unlock the content.

Enter your password Unlock

Challenge Classification and Difficulty Level

At first glance, Touch feels small and direct, which is why many beginners can approach it with confidence. Its challenge classification is easier than many multi-step Hack The Box machines because the path depends more on understanding one broken system setting than on chaining many unrelated bugs.

You are mainly dealing with SUID behavior, umask, and preload abuse. That keeps the difficulty level low to moderate for learners, especially if you already know basic shell usage and how Linux creates files under different privilege contexts.

Objective and Flag Requirements

Your goal is simple: move from limited access to full control and collect the root flag. The path begins in the home directory, where you can spot the link to the touch binary and start checking how it behaves under elevated execution.

The flag requirements push you to focus on sensitive files rather than noisy exploitation. You are not expected to brute force anything. Instead, you inspect permissions, test file creation, and learn how writable root-owned files can lead to complete compromise.

For beginners, the best tip is to slow down and confirm every assumption. Check ownership, read binary permissions carefully, and compare file results before and after changing the shell environment. Those small observations explain the vulnerability better than rushing straight to the final flag.

Preparing for the Touch HTB Challenge

Before you start, make sure your attack machine is ready for simple file work, compiling, and encoding data. Touch does not need a huge toolkit, but you do need proper access to the box and a clean way to move files when the shell is weak.

Another practical point is proper terminal setup. This machine can leave you with awkward shell behavior, so plan for limited interactivity. The next sections cover the exact tools and core skills that make the workflow smoother.

Necessary Tools and Setup for Windows Machines

Even though the prompt mentions Windows machines, the compiled path for Touch is centered on Linux behavior. So your setup should focus on running a basic nmap scan, compiling a shared object, and managing a restricted shell command workflow from your own system.

You do not need a long tool list. What matters is proper terminal settings on your side and a way to prepare files before sending them over. Because the shell can be poor, it helps to do as much work as possible locally.

• Use nmap scan results to identify open ports, especially SSH on port 22.
• Prepare gcc locally so you can build the malicious library before transfer.
• Keep base64 and split ready for the transfer method to the target shell.
• Verify the touch binary behavior with simple shell command testing once inside.

Key Skills Every Beginner Should Have

What helps most here is not advanced exploitation. You need basic shell usage, patience, and the habit of checking outputs carefully. Touch rewards small checks more than flashy tricks, especially when you start comparing ownership and permissions after each action.

You should also understand binary permissions and at least one core system setting: umask, which is a fundamental setting. Once you see how a setuid program creates files, the whole attack path becomes much easier to reason about.

• Read permission strings like rws and understand why the setuid bit matters.
• Know how to inspect a system setting such as umask from the current shell.
• Be comfortable creating a file, checking ownership, and testing write access.

Initial Reconnaissance Techniques

Recon on Touch is short but important. Start with an nmap scan to identify open ports and decide what access methods may matter later. Port 22 stands out because SSH becomes relevant once you understand how root-owned writable files can be created.

From there, move into local inspection. Focus on file permissions, especially around the touch binary and anything linked from the user area. Those findings shape the entry and escalation strategy covered next.

Scanning and Service Enumeration Strategies

The first practical step is service enumeration. A quick nmap scan gives you the open ports picture and helps you understand whether there is a clean remote management option. In this case, SSH matters because it suggests one possible use for a writable root-owned path later on.

Once you have access, enumeration shifts from network to local behavior. That means checking the touch binary, listing its permission bits, and then using the command umask to create a test file to learn how the machine handles ownership and default modes.

• Run an nmap scan and note open ports before choosing your direction.
• Use ls -l on the touch binary to confirm the SUID and SGID bits.
• Create a test file and compare its permissions with the current umask value.

Identifying Potential Entry Points

On this target machine, the real entry point is not a memory bug or a web flaw. It is the combination of proper access, a SUID binary, and a shell that lets you run enough commands to test file creation. That is why local enumeration becomes the turning point.

Your attack machine supports the heavy lifting, while the target gives only limited execution. A reverse shell is not the ideal final answer here because the environment can lack stable terminal control. The better path is to use file-based privilege escalation.

• Check if the shell can run touch, ls, umask, and echo reliably.
• Watch for root-owned files that remain writable after creation.
• Favor a durable escalation path over a fragile reverse shell.

ALSO READ: Management Walkthrough: Beginner’s Writeup from Hack The Box

Exploitation Pathways in Touch HTB Writeup

The exploit methodology in Touch grows from one core primitive: creating arbitrary executable files as root and influencing their permissions through umask. Once that works, you can start thinking about what root-controlled paths would be most useful to abuse.

A strong route is dynamic linker hijacking through a library injection attack. The machine allows you to prepare a shared object, place its path into a preload file, and then trigger code execution with elevated rights. A feature of interactive shells is also essential, as it allows proper terminal settings. The next two sections explain that flow clearly.

Vulnerability Analysis and Common Exploits

The weakness in Touch is really a permissions flaw. Because the touch binary runs with root privileges, it can create files owned by root. If you first control umask from your current shell with normal user privileges, you can influence how open those new files are to other users.

That primitive leads to several options, but the documented exploitation method focuses on a library injection attack. By creating and editing /etc/ld.so.preload, you can force the system to load a malicious library with no new line symbol before the standard c library whenever a program starts.

• Abuse SUID touch to create root-owned files in chosen locations.
• Set umask to 0000 so the permissions of the created file stay writable.
• Use dynamic linker hijacking by pointing preload to a malicious library.

Step-by-Step Exploitation Process

Here is the practical flow. First, inspect the touch binary permissions and verify that it is setuid root. Next, test file creation under the default umask, then switch the current shell to umask 0000 and repeat a little bit. That proves you can generate writable root-owned files.

After that, build a shared object from c code on your local system. The malicious code should remove the preload file to prevent recursion, unset LD_PRELOAD, set root IDs, and run a shell command that adds the setuid bit to /bin/bash. This avoids the unstable reverse shell problem, even with our poor shell capabilities.

• Compile the shared object locally as xpl.so.
• Encode it with base64 and split it into smaller parts.
• Rebuild and decode it on the target.
• Create and edit /etc/ld.so.preload, then trigger touch again.

Gaining User Access on Touch Hack The Box

Touch is unusual because the writeup path is less about stealing a password and more about working with the rights already exposed by the machine. The created user context matters mainly because you begin with limited user permissions and must turn them into something stronger.

One possible branch mentioned in the compiled notes is writing a public key into a root-controlled SSH location. Another branch uses the same transfer method ideas to move a shared object and escalate locally. Both depend on careful file creation.

Methods for Obtaining Initial Credentials

The compiled material does not describe a password theft stage, so the emphasis is on what you do after getting proper access. Once inside, initial credentials are less important than understanding how weak user permissions can still be turned into root control through a privileged helper.

A smart beginner move is to treat every file creation result as evidence. When command touch creates a root-owned file that you can still modify, you are already on the path to escalation. From there, preload abuse becomes possible because the dynamic linker checks files before loading the standard c library.

• Confirm you can execute touch from the limited account.
• Test whether created root-owned files stay writable after umask changes.
• Choose either SSH key placement or preload abuse as the next step.

Privilege Escalation Basics for Beginners

For beginners, privilege escalation on Touch is a lesson in chaining small facts. The setuid bit on the touch binary means the program acts as the file owner (root) while it runs. That alone is not enough, but it becomes dangerous when paired with a permissive umask value.

The main idea is to create a setuid primitive somewhere else. In the compiled path, the malicious shared library does not try to give you a clean interactive shell. Instead, it changes /bin/bash so that you can later run bash -p and inherit root safely.

• Learn why the setuid bit changes the execution context of a program.
• Recognize that a setuid primitive can be created indirectly through preload abuse.

Capturing the Root Flag in Touch HTB Writeup

By the time you reach the root flag, most of the hard work is already done. You have used proper access, weak file handling, and linker behavior to turn a small permissions issue into full control over the machine.

The final steps are about staying organized. Confirm the preload trigger worked, use the elevated bash path, and then read the sensitive files you need. The sections below explain the last escalation details and how to collect proof cleanly.

Advanced Privilege Escalation Techniques

The advanced concept in Touch is simple in theory but powerful in practice. Preload libraries let the entire system load a chosen shared object before other dependencies. If you can control that path through a writable preload file, dynamic linker hijacking becomes a system-wide attack.

That is why this box is memorable. You are not just altering one continuous process. You are influencing what gets loaded whenever a binary starts, which opens the door to further system compromise if left in place. The compiled exploit avoids long-running shell problems by making bash itself setuid.

• Create /etc/ld.so.preload with root ownership through touch.
• Write the path to your shared object into that file.
• Trigger execution so the payload sets a reusable privilege escalation path.

Final Steps and Proof Collection

Before triggering the final stage, check the integrity of file transfer. The compiled notes recommend rebuilding the base64 content on the box and comparing the final size so you know the shared object was not damaged during paste operations.

Next, trigger the preload path by executing the affected binary. Once /bin/bash has the setuid bit, run bash -p to become root while considering command length restrictions. From there, move to proof collection carefully and gather the expected flag data from the proper location.

• Verify the rebuilt shared object before decoding and using it.
• Confirm /bin/bash permissions changed after the preload trigger.
• Read the root flag and review the home directory only as needed.

Conclusion

In conclusion, mastering the Touch challenge on Hack the Box is not just about technical skills but also about strategic thinking and persistence. As you navigate through the challenges, remember to leverage the tools and techniques discussed to enhance your approach. Whether you’re scanning for vulnerabilities or diving into privilege escalation, each step is a learning opportunity that contributes to your growth as a cybersecurity enthusiast. The journey may be tough, but with practice and dedication, you can conquer it! If you’re ready to take your skills to the next level, don’t hesitate to reach out for a free trial or consultation to help guide your progress. Happy hacking!

Frequently Asked Questions

How does the Touch challenge compare to other HTB Windows machines?

Touch is a Windows machine. In comparison to many HTB targets, its difficulty level is beginner friendly. The challenge classification centers on permissions abuse, though the very primitive shell and very limited shell capabilities can still slow you down.

Are there recommended resources or official walkthroughs for Touch Hack The Box?

The compiled notes mention using related writeups and Hacktricks for expand study, especially for the exploit methodology and the example xpl shared library idea. If an official walkthrough exists on Hack The Box, it would be worth checking after finishing the machine on your own.

Where can I find community discussions or similar challenges to Touch HTB Writeup?

Community discussions are usually easiest to find in Hack The Box spaces and writeup sites that focus on Windows and Linux. Look for similar challenges that involve SUID, linker abuse, or the permissions of the created file, since those ideas match this machine and help your attack machine workflow.