Unobtainium

Verified writeups for the Unobtainium machine of Hack The Box

Unobtainium

$ tldr CloudStorage command injection + prototype pollution → kubectl secrets

·	·
Operating system	Linux
Difficulty	Hard
Vector	Web
IP	10.10.10.235
Retirement date	2021-09-04
Skills	Inspecting custom application Code Analysis Information Leakage Local File Inclusion (LFI) Google CloudStorage Commands Vulnerability (Command Injection) [RCE] Prototype Pollution Exploitation (Granting us privileges) Kubernetes (Interacting with the API) [kubectl] Finding containers with kubectl PIVOTING Abusing Prototype Pollution to jump to another container Listing secrets with kubectl Creating malicious Pod (Privilege Escalation) [Bad Pods] Peirates - Kubernetes Penetration Testing Tool [EXTRA]

Writeups

Language	Author	Format	Link
🇪🇸 ES	S4vitar	Vídeo	Open
🇬🇧 EN	0xdf	Texto	Open
🇬🇧 EN	IppSec	Vídeo	Open

Skill resources

Curated documentation for each technique listed in the Skills column above. Sources: HackTricks, GTFOBins, PortSwigger, etc.

Skill	Source	Link
Local File Inclusion (LFI)	HackTricks	Open
Local File Inclusion (LFI)	PayloadsAllTheThings	Open
Information Leakage	HackTricks	Open
Prototype Pollution	PortSwigger	Open
OS Command Injection	PortSwigger	Open
Port Forwarding / Pivoting	HackTricks	Open
Remote Code Execution (RCE)	HackTricks	Open

Related skills worth mastering

Remote File Inclusion (RFI) · Shellshock (CVE-2014-6271)

If you liked this machine, try

• OpenSource — Linux, Easy
• ScriptKiddie — Linux, Easy
• Talkative — Linux, Hard
• Netmon — Windows, Easy
• Sniper — Windows, Medium

---

Comments & tips

Did the official writeup not work? Found a smarter trick? Share it here — comments live in GitHub Discussions.

Last updated: 2026-06-07