Player

Verified writeups for the Player machine of Hack The Box

Player

$ tldr JWT forge → ffmpeg AVI LFI → Codiad IDE RCE → privesc

·	·
Operating system	Linux
Difficulty	Hard
Vector	Web
IP	10.10.10.145
Retirement date	2020-01-18
Skills	Subdomain Enumeration JWT Enumeration Information Leakage - Abusing No Redirect Playing with BFAC (Backup File Artifacts Checker) in order to find a configuration file PHP Source Code Analysis Forge JWT Abusing ffmpeg AVI Exploit in order to read internal files Escaping Limited Shell - OpenSSH 7.2p1 (Authenticated) XAuth Command Injection Abusing Codiad IDE in order to execute commands (RCE - www-data) Abusing Cron Job (Privilege Escalation)

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇪🇸 ES	El Pingüino de Mario	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Subdomain Enumeration	HackTricks	Open
Information Leakage	HackTricks	Open
OS Command Injection	PortSwigger	Open
Remote Code Execution (RCE)	HackTricks	Open
JSON Web Tokens (JWT)	PortSwigger	Open

Related skills worth mastering

Local File Inclusion (LFI) · Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• Backend — Linux, Medium
• BackendTwo — Linux, Medium
• Noter — Linux, Medium
• Netmon — Windows, Easy
• Obscurity — Linux, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07