HackTheBox Sloink: NFS Misconfiguration Chains to Full Root Compromise

A HackTheBox machine named Sloink was compromised through a series of chained vulnerabilities beginning with publicly exposed NFS shares that leaked a user's PostgreSQL command history. The history contained an MD5 hash which, once cracked, revealed the password for a 'service' account whose shell was set to /bin/false, preventing direct login. However, SSH port forwarding remained functional, allowing the attacker to tunnel directly to the PostgreSQL Unix socket and authenticate as the database superuser. From there, the PostgreSQL COPY FROM PROGRAM feature was abused to achieve remote code execution, enabling SSH key injection and a shell as the postgres user. Finally, a root-owned cron job that copied the postgres data directory — writable by the postgres user — was exploited by planting a SUID bash binary, which upon execution granted a full root shell.