HTB Nimbus Complete Writeup - SSRF, IMDS Credential Theft, LocalStack Abuse & modprobe Container Escape

A comprehensive penetration testing guide exploiting an SSRF bypass via octal/decimal IP encoding to steal EC2 IMDS credentials, abusing a LocalStack AWS emulator with proxy-only IAM enforcement, injecting malicious YAML into an SQS queue for worker RCE, and escalating through a privileged CodeBuild container with a BASH_FUNC gosu bypass to achieve host root via modprobe usermode-helper abuse.

July 22, 2026 • views • 10 min read • 1,059 words

By

Havoc

hackthebox 30 htb 34 linux 14 cloud 2 aws localstack ssrf server-side-request-forgery imds instance-metadata-service ec2 iam credential-theft sqs yaml deserialization 2 unsafe-yaml-load rce 9 remote-code-execution 3 docker 3 container-escape privileged-container codebuild gosu-bypass bash-func modprobe usermode-helper kernel-exploit overlayfs cap-sys-admin octal-ip-bypass decimal-ip-bypass blocklist-bypass sqs-injection floci season11 8 hard-difficulty 3 job-scheduler nimbus-web-role worker-rce exfiltration lateral-movement 9 privilege-escalation 21 host-root