Hack The Box Armexis Walkthrough

Posted Aug 6, 2026 Updated Aug 7, 2026

By Elmehdi Laassiri

4 min read

Scenario :

In the depths of the Frontier, Armaxis powers the enemy’s dominance, dispatching weapons to crush rebellion. Fortified and hidden, it controls vital supply chains. Yet, a flaw whispers of opportunity, a crack to expose its secrets and disrupt their p

Solution :

So first we are given a ZIP file as well as 2 Hosts :

First let’s unzip the file using the password they have given us :

We’re given the entire application :

But first let’s check the 2 IP addresses that we were given :

00 :

The first one is a Login page .

01 :

The second one is the mail box for the email : test@email.htb :

I first tried Fuzzig for other directories starting with the first host 00 :

We find 2 interesting endpoints /ResetPassword and /Weapons which returns a 404 .

Let’s first check the Reset Password feature :

We first need to specify the account , and it will probably send us an OTP , we already have the Mail box for the test@email.htb user so let’s use that one :

First we need to create this account using the register endpoint :

Then we can request a Password reset :

For this one we need to provide a Token , then the new password , first we need a Valid Token , which we will recieve on our Mail box :

Now back to the reset page , we specify this token and the new password :

And the password is successfuly changed , now let’s check Burp :

We see that in the POST Request we’re sending an email + Token and the new email , what if we send a valid Token and modify the email to the admin email , can we reset the admin password that way ?

First let’s request a new Token :

Now using this new Token , let’s try and modify the password for the admin , now back to our Burp request , send it to Repeater :

We just replace the token with our new one , and we’re just hoping that the admin email follows the same structure as our given user :

  
{
"token":"fdb516f0900d8ba01bb247f7bdde2c4c",
"newPassword":"123456",
"email":"admin@email.htb"
}

We get User not found , i tried multiple ones , (eg Admin , Administrator ….) but none of them was correct .

Now let’s go back to our ZIP file :

Looking at the folder structure , few files might be useful for us , first the index.js , then route/index.js , email-app/index.js , as all of these might contain the administrator email inside the code :

Let’s navigate the entire codebase recursively using grep and filter for admin :

grep -r admin

Perfect we found the admin email , we can test with this :

admin@armaxis.htb

Now back to Burp :

Perfect now let’s login using the administrator account :

Once inside we find the weapons endpoint which returned 401 earlier :

Checking Burp as well doesn’t return anything useful :

Let’s go back to our code base to read the /weapons section :

We find this :

  
  try {
    const parsedNote = parseMarkdown(note);

Let’s check the codebase for this function :

Let’s read the challenge/markdown.js file :

This is a huge indicator of a command injection :)

The url comes straight from a markdown image tag “alturl” that a user controls, and it’s being dropped directly into a shell command string with no sanitization or escaping. execSync runs this through /bin/sh, so anything that breaks out of the “URL” context gets executed as a shell command.

This is pretty simple notation tho :