Post

"Interpreter" - HackTheBox Walkthrough (Season 10)

Step by step walkthrough of the Interpreter HackTheBox machine. Covers exploiting NextGen Healthcare Mirth Connect and privilege escalation.

"Interpreter" - HackTheBox Walkthrough (Season 10)

HackTheBox “Interpreter” Writeup

A walkthrough of the HackTheBox Interpreter machine (Season 10) , a Medium rated Linux box. this blog covers initial access, lateral movement, and privesc.

Initial Reconnaissance

Standard nmap scan first, machine IP is 10.129.34.4:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
┌──(kali㉿kali)-[~]
└─$ nmap -A -T5 10.129.34.4
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-22 08:15 -0500
Nmap scan report for 10.129.34.4
Host is up (0.12s latency).
Not shown: 997 closed tcp ports (reset)
PORT    STATE SERVICE  VERSION
22/tcp  open  ssh      OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0)
| ssh-hostkey:
|   256 07:eb:d1:b1:61:9a:6f:38:08:e0:1e:3e:5b:61:03:b9 (ECDSA)
|_  256 fc:d5:7a:ca:8c:4f:c1:bd:c7:2f:3a:ef:e1:5e:99:0f (ED25519)
80/tcp  open  http     Jetty
| http-methods:
|_  Potentially risky methods: TRACE
|_http-title: Mirth Connect Administrator
443/tcp open  ssl/http Jetty
|_http-title: Mirth Connect Administrator
|_ssl-date: TLS randomness does not represent time
| http-methods:
|_  Potentially risky methods: TRACE
| ssl-cert: Subject: commonName=mirth-connect
| Not valid before: 2025-09-19T12:50:05
|_Not valid after:  2075-09-19T12:50:05
Device type: general purpose
Running: Linux 4.X|5.X
OS details: Linux 4.15 - 5.19

Nmap done: 1 IP address (1 host up) scanned in 28.70 seconds

Three open ports, OS is Linux (Debian):

  • 22: OpenSSH 9.2p1
  • 80: Jetty HTTP (Mirth Connect Admin)
  • 443: Jetty HTTPS (Mirth Connect Admin, self-signed cert)

Port 80 just takes us to 443, so lets head there.

Secured
🔒

Active HackTheBox Challenge

This challenge is currently active on HackTheBox. According to HTB's content policy, sharing writeups of active challenges is prohibited.

This writeup will be made publicly available once the challenge is retired. If you wish to know the password or discuss the challenge, please reach out via the social links below.

My Views

At the end of the day, Very weird box, Can understand why it only has a 2.6/5 rating on HTB : )

This post is licensed under CC BY 4.0 by the author.