https://blog.iveverita.com/Recent content on iveveritaHugoen-usFri, 13 Nov 2026 00:00:00 +0000https://blog.iveverita.com/posts/touch/Fri, 13 Nov 2026 00:00:00 +0000https://blog.iveverita.com/posts/touch/<h2 id="htb-touch--writeup">HTB Touch — Writeup</h2> <p><strong>Difficulty:</strong> Easy | <strong>OS:</strong> Windows | <strong>Points:</strong> 20 pts / 585 XP</p> <hr> <h2 id="overview">Overview</h2> <p>Touch continues directly from the <strong>Layover</strong> machine — HTB hands players a name and booking confirmation code (<code>Jenny Crawford</code> / <code>KS7X2M</code>) said to have been &ldquo;uncovered&rdquo; there. The box centers on a self-service kiosk application (<strong>Nexion DeviceHub</strong>) running a document/passport check-in flow, which can be broken out of to reach a full Windows session. Privilege escalation abuses a custom plugin-loading printer service that runs as <strong>SYSTEM</strong>.</p>