Overview
MakeSense is a hard Linux box themed around client-side AI (speech-to-text and handwriting OCR). The foothold chains a custom WordPress theme's voice feature into a stored XSS: the theme encrypts submissions client-side with a hard-coded AES key, so a forged payload can be decrypted and stored server-side, then rendered unescaped in the admin review panel — an admin bot executes it and creates an attacker admin. Admin access leads to RCE via a malicious plugin. Credentials from wp-config.php pivot to the user walter. Root is an internal handwriting-OCR service that saves recognised text to attacker-named files in a web-served directory while running as root — an arbitrary PHP write for code execution.
Enumeration
Nmap Scan
nmap -sC -sV -oN makesense_initial.txt makesense.htbRelevant ports:
- Port 22: OpenSSH
- Port 80: dead / no response
- Port 443: WordPress site (Apache 2.4.58, Ubuntu)
- Port 8001: filtered from outside — an internal service (revisited for root)
WordPress Recon
wpscan --url https://makesense.htb --disable-tls-checks \
--enumerate u,t --plugins-detection passive -t 50Findings: WordPress 7.0, XML-RPC enabled, directory listing on wp-content/uploads/, users walter, jake, admin, and a custom theme webagency. A stray voice-message.wav in the uploads directory is a red herring (a demo of the transcription feature) — the real attack surface is the theme's JavaScript.
This box is still active
MakeSense is currently an active machine on HackTheBox, so the exploitation chain is kept locked out of respect for the platform's rules. If you've already rooted it, enter the root flag to unlock the rest of the write-up. It opens for everyone automatically once the box retires.
That doesn't match the root flag — try again.