Hack The Box - HTB Cohort Writeup - Easy - Weekly - August 1st, 2026

Box: Cohort · OS: Linux (Ubuntu 24.04) · Difficulty: Easy

Step 1 — Recon

Goal: find the attack surface.

sudo ip link set dev tun0 mtu 1300      # do this first, see note
echo '<TARGET> cohort.htb' | sudo tee -a /etc/hosts
sudo nmap -p- --min-rate 2000 -T4 -Pn <TARGET>
sudo nmap -p22,80,443 -sCV -Pn <TARGET>

Result:

22/tcp  open  ssh      OpenSSH 9.6p1
80/tcp  open  http     nginx 1.24.0   → 301 https://cohort.htb/
443/tcp open  ssl/http nginx 1.24.0
| ssl-cert: Subject: commonName=cohort.htb
| Subject Alternative Name: DNS:cohort.htb, DNS:*.cohort.htb

What matters: the certificate SAN contains *.cohort.htb — a wildcard.
That tells you a subdomain is part of this box. Remember it; Step 5 is where you
find out which one.

Note — set the MTU first. On the HTB VPN, large outbound requests
black-hole on tun0: the connection opens and then silently stalls, which
looks exactly like a broken box. mtu 1300 prevents it.

Note — don't bother fuzzing. nginx returns the same 908-byte page for
every unknown path and a 178-byte 301 for every unknown vhost, so a fuzzer
matches everything. The subdomain you need is random hex and is not in any
wordlist — it gets disclosed to you in Step 5, not guessed.

Step 2 — Deobfuscate app.js

Goal: recover the site's real source code.

The homepage is an empty shell — all logic is client-side:

<div id="app" data-page="home" aria-busy="true"></div>
<script src="/assets/app.js" defer></script>

So app.js is where every server route is documented.

curl -sk https://cohort.htb/assets/app.js -o app.js     # ~123 KB

It is packed with obfuscator.io. Three parts you need to understand:

Every string in the file is a call like a0_0x41a8(0x2e5,'cKx]').

2a. Resolve the calls

The decoder is deterministic, so you can run it in isolation and rewrite every
call site with its literal value (deob.js):