Garfield — HackTheBox
Writable logon-script attributes and RBCD led to an RODC KeyList attack and domain admin access.
hard
01 / ARCHIVE
Writeups
Machine walkthroughs and web challenge notes, with the attack path and technical lessons preserved.
No tags match that search.
NEWEST FIRSTShowing 23 of 23 posts
Pirate — HackTheBox
Weak machine account credentials enabled an internal pivot, NTLM relay, RBCD, and an SPN hijack to domain admin.
hard
Nimbus — HackTheBox
SSRF exposed LocalStack credentials, leading through SQS job execution to a privileged container and host escape.
hard
Timelapse — HackTheBox
An encrypted WinRM certificate backup and PowerShell history led to credentials and LAPS administrator access.
easy
Cicada — HackTheBox
A default password and exposed AD descriptions led to WinRM access and SeBackupPrivilege-based domain compromise.
easy
Active — HackTheBox
Anonymous SMB access exposed a GPP password; Kerberoasting then recovered the domain administrator account.
easy
Escape — VulnLab
An RDP kiosk was escaped through Edge file browsing; recovered admin credentials and a UAC bypass gave full access.
easy
Forgotten — VulnLab
A LimeSurvey installer pointed at a rogue database gave admin RCE; a writable Docker mount planted a SUID root shell.
easy
Build — VulnLab
An exposed rsync backup led through Jenkins and Gitea to PowerDNS hijacking and passwordless rsh.
medium
Code — HackTheBox
A Python sandbox escape gave code execution; SQLite credential reuse and a backy.sh traversal archived root.
easy
PermX — HackTheBox
A Chamilo upload flaw (CVE-2023-4220) gave RCE; reused DB credentials and a symlink ACL flaw gave root.
easy
Conversor — HackTheBox
An absolute-path upload wrote a cron script for RCE; SQLite reuse and a needrestart config gave root.
easy
LinkVortex — HackTheBox
An exposed .git history leaked Ghost credentials; a CVE-2023-40028 file read and a sudo environment flaw gave root.
easy
Gavel — HackTheBox
An exposed Git repository revealed SQL injection and dynamic PHP execution, followed by a daemon sandbox escape.
medium
Infection — HackTheBox
Django Q-object parameter injection bypassed authentication and a document lock to expose database credentials.
easy
Titanic — HackTheBox
A path traversal in a Flask download endpoint leaked Gitea hashes; PBKDF2 cracking and an ImageMagick hijack gave root.
easy
GiveBack — HackTheBox
GiveWP exploitation led through Kubernetes secrets to host access and a restricted runc wrapper escape.
medium
Soulmate — HackTheBox
A CrushFTP authentication bypass exposed a web shell path; hardcoded credentials and Erlang SSH led to root.
easy
CodePartTwo — HackTheBox
A js2py RCE (CVE-2024-28397) gave a web shell; cracked SQLite credentials and a sudo-allowed backup tool led to root.
easy
Imagery — HackTheBox
Stored XSS, path traversal, and ImageMagick command injection led to a backup credential and root cron job.
medium
CSP Bypass: When script-src Becomes Your Weapon
A reflected XSS became executable through an injectable same-origin JavaScript endpoint allowed by CSP.
JSON CSRF: When "It's JSON" Isn't a Defense
A text/plain form submission bypassed a JSON share action without CSRF protection and exposed an admin note.
When JavaScript Becomes the Data Leak: An XSSI Story
An executable secrets.js response let an attacker-controlled page receive and exfiltrate another user's secret.
No posts match these filters.