HackTheBox - BountyHunter

BountyHunter features a website that is vulnerable to XXE attack. Exploiting it allows me to …

HackTheBox - Nunchucks

SSTI in Nunjucks and SUID capability on Perl

HackTheBox - Explore

Exploiting ES File Explorer and abusing ADB

HackTheBox - Return

Return is another machine listed in the HTB printer exploitation track. This machine hosts a web …

HackTheBox - Antique

Antique is one of the machines listed in the HTB printer exploitation track. It features a network …

HackTheBox - Dynstr

Dynstr imitates a company that offers a Dynamic DNS service. The provided API for this service is …

HackTheBox - Cap

Cap starts by identifying an IDOR vulnerability on its hosted website. Using this IDOR, I can obtain …

HackTheBox - Pit

As a medium difficulty box, Pit from Hack The Box has a well-designed enumeration flow.

HackTheBox - Validation

Second-order SQL injection

HackTheBox - Schooled

Moodle exploitation using CVEs

HackTheBox - Gobox

SSTI in Golang, abuse S3 bucket, and NGINX backdoor

Linux · S3 · AWS · LocalStack · Go · SSTI

HackTheBox - Knife

Exploiting the backdoor planted in PHP 8.1-dev

Linux · PHP · GTFOBins · Sudo · Knife

HackTheBox - Love

SSRF in beginner-level

HackTheBox - TheNotebook

Abusing JWT key identifier and breaking out of a Docker container

Linux · JWT · Webshell · CVE-2019-5736 · Docker · Sudo

HackTheBox - Ophiuchi

Deserialization attack on YAML and reversing web assembly

HackTheBox - Traverxec

Code execution with path traversal

HackTheBox - Writeup

TIL: The staff group allows you to override binaries' executable paths.

HackTheBox - Heist

Learn how RID cycling could be used for enumerating AD users

HackTheBox - Armageddon

Pwning Drupal 7 CMS with Drupalgeddon and abusing Snap with malicious snap package

HackTheBox - Active

Finding passwords in Group Policy Preferences and roasting Kerberos

HackTheBox - Shocker

Hands on with ShellShock vulnerability

HackTheBox - Atom

Supplying a malicious update definition to Electron-updater

HackTheBox - Spectra

Getting password from automatic login script of ChromeOS

HackTheBox - Tenet

Friendly PHP insecure deserialization attack and race condition

HackTheBox - ScriptKiddie

Exploiting exploitation tools and command injection in a log file

HackTheBox - Cereal (User)

Chaining XSS, SSRF, and deserialization vulnerabilities to get RCE

HackTheBox - Delivery

Exploiting a logic flaw called TicketTrick

HackTheBox - Ready

Turns SSRF to remote code execution and escape from a Docker container

HackTheBox - Time

Exploiting an insecure deserialization on Jackson library and how to mitigate it

HackTheBox - Passage

Leveraging USBCreator for local privilege escalation on Linux

HackTheBox - Omni

Unauthenticated RCE as SYSTEM on Windows 10 IoT

HackTheBox - Bucket

Pentesting against simulated AWS S3 Bucket

Linux · AWS · LocalStack · S3 · DynamoDB · Webshell

HackTheBox - Laboratory

LFI to RCE on GitLab 12.8.1~12.9.0

HackTheBox - APT

Enumerating network interfaces of a remote computer via MSRPC and exploit NTLMv1

HackTheBox - Sauna

Learn basic exploitation of Active Directory

HackTheBox - Forest

Using BloodHound to discover abusable Active Directory groups

HackTheBox - Doctor

Seven times seven is equal to SSTI

HackTheBox - Worker

Learn how Azure Pipelines can be abused

HackTheBox - SneakyMailer

Example of a phishing attack and PyPI package exploitation

Linux · SMTP · IMAP · Sylpheed · Phishing · Webshell

HackTheBox - Buff

Tunneling with Chisel to deliver a buffer overflow exploit

HackTheBox - Tabby

Abusing Tomcat manager-script roles and escalate to root with LXC container

HackTheBox - Blackfield

Abusing Backup Operators group to dump Active Directory database

HackTheBox - ServMon

Exploiting embedded system software

HackTheBox - Cascade

Plundering dead Active Directory accounts

HackTheBox - Nest

Nest is one of my favorite machines after Forest, I learned a lot about enumeration here, especially …

HackTheBox - Remote

Enumerating public NFS and gain access to sensitive files

HackTheBox - Magic

SQLi for login bypass and embed webshell to an image file

HackTheBox - OpenAdmin

Exploiting OpenNetAdmin vulnerability and sudo nano