Logo

writeup

Technical writeups and documentation

55posts ← Back to all categories
HackTheBox - EscapeTwo Writeup

HackTheBox - EscapeTwo Writeup

EscapeTwo is an easy Windows machine focused on full domain compromise. Starting with low-privileged credentials, we extract more creds from a corrupted Excel file, gain MSSQL and WinRM access, and discover ADCS misconfigurations. Exploiting these flaws leads to the Administrator hash and full domain control.

S SH∆FIQ∆IM∆N
May 27, 2025
1 min read
smb smbmap smbclient-ng netexec-mssql impacket-mssqlclient mssql netexec-winrm evil-winrm xp_cmdshell bloodhound sharphound powerview.ps1 account-cert-publishers-group writeowner certipy-ad adcs-esc4 rubeus psexec-hash psexec.py impacket-psexec
HackTheBox - UnderPass Writeup

HackTheBox - UnderPass Writeup

Underpass is an easy Linux machine on Hack The Box. It involves SNMP enumeration to discover a Daloradius panel with default credentials. From there, a crackable user hash leads to SSH access. Privilege escalation is achieved via mosdh-server, allowing root access.

S SH∆FIQ∆IM∆N
May 14, 2025
1 min read
snmp snmpwalk daloradius daloradius-default-creds crackstation mosh mosh-server
HackTheBox - LinkVortex Writeup

HackTheBox - LinkVortex Writeup

LinkVortex is an easy Linux machine on Hack The Box that showcases symlink exploitation. It begins by dumping an exposed .git directory to access Ghost CMS, which is vulnerable to CVE-2023-40028. This flaw allows authenticated symlink uploads to read arbitrary files inside the container, exposing host credentials. Privilege escalation is achieved via a sudo script vulnerable to a chained symlink technique, leading to full root access.

S SH∆FIQ∆IM∆N
April 28, 2025
1 min read
ghost ghost-v5.58 ffuf-vhost git-dumper CVE-2023-40028 chained-symlink
HackTheBox - Precious Writeup

HackTheBox - Precious Writeup

Precious is an easy Hack The Box Linux machine focused on Ruby exploitation. It features a vulnerable Ruby web app using pdfkit (CVE-2022-25765) that enables RCE. Plaintext credentials in a Gem config file allow lateral movement. The final privilege escalation uses insecure Ruby deserialization for root access.

S SH∆FIQ∆IM∆N
April 6, 2025
1 min read
pdfkit pdfkit-v0.8.6 CVE-2022-25765 tcpdump ruby-yaml rce
HackTheBox - Topology Writeup

HackTheBox - Topology Writeup

Topology is an easy Hack The Box Linux machine featuring a vulnerable LaTeX web app with a Local File Inclusion (LFI) flaw. The LFI exposes an .htpasswd file containing a crackable hash, leading to SSH access. Privilege escalation is achieved via a root cronjob that executes malicious gnuplot files.

S SH∆FIQ∆IM∆N
March 30, 2025
1 min read
latex formula .htpasswd hashcat gnuplot pspy ffuf-vhost
HackTheBox - Active Writeup

HackTheBox - Active Writeup

Active is an easy Hack The Box Windows machine set in an Active Directory environment. Anonymous SMB access reveals a Groups.xml file with a GPP-encrypted password, leading to domain credentials and the user flag. Kerberoasting a user with an SPN yields a crackable TGS hash, granting Administrator access via PsExec and full system compromise.

S SH∆FIQ∆IM∆N
March 23, 2025
1 min read
smb smbmap smbclient-ng groups.xml group-policy-file gpp-decrypt ldap ldapsearch impacket-GetADUsers kerberoasting ldapsearch-SPN hashcat impacket-psexec kerberos
HackTheBox - Sauna Writeup

HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read
ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Analytics Writeup

HackTheBox - Analytics Writeup

Analytics is an easy Hack The Box Linux machine featuring exposed HTTP and SSH services. A Metabase instance vulnerable to CVE-2023-38646 allows pre-auth RCE and initial access inside a Docker container. Environment variables expose SSH credentials for the host. Privilege escalation is achieved by exploiting the GameOverlay kernel vulnerability for root access.

S SH∆FIQ∆IM∆N
March 9, 2025
1 min read
CVE-2023-38646 CVE-2023-2640 CVE-2023-32629 metabase metabase-v0.46.6 linpeas gameOverlay overlayfs ubuntu-22.04LTS-kernel-6.2.0-25-generic
HackTheBox - Chemistry Writeup

HackTheBox - Chemistry Writeup

Chemistry is an easy Hack The Box Linux machine highlighting RCE in the pymatgen library (CVE-2024-23346) via a malicious CIF file upload. Cracked credentials allow SSH access as rosa. Privilege escalation is achieved by exploiting a path traversal in AioHTTP (CVE-2024-23334) for arbitrary file read, revealing the root flag.

S SH∆FIQ∆IM∆N
March 9, 2025
1 min read
ssh-port-forward sqlite-dump CVE-2024-23346 CVE-2024-23334 aiohttp-3.9.1 crackstation lfi rce cif-file
HackTheBox - Codify Writeup

HackTheBox - Codify Writeup

Codify is an easy Hack The Box Linux machine featuring a Node.js code execution app using a vulnerable vm2 library, allowing RCE. A SQLite database reveals a crackable hash, granting SSH access. Privilege escalation is achieved via a misconfigured Bash script that exposes the root password.

S SH∆FIQ∆IM∆N
March 2, 2025
1 min read
nodejs vm2 vm2-v3.9.16 hashcat wildcard-injection pspy