writeup

Technical writeups and documentation

55posts Page 2 of 6 ← Back to all categories

HackTheBox - CozyHosting Writeup

CozyHosting is an easy Hack The Box Linux machine running a Spring Boot app with exposed Actuator endpoints. Session hijacking grants dashboard access, and a command injection vulnerability provides a reverse shell. Hardcoded credentials in the JAR file reveal a database hash, which, once cracked, allows SSH access as josh. The user can run ssh as root, leading to full privilege escalation.

SH∆FIQ∆IM∆N

February 23, 2025

1 min read

spring-boot-error spring-boot gobuster PostgreSQL hashcat GTFOBins

HackTheBox - Devvortex Writeup

Devvortex is an easy Hack The Box Linux machine running Joomla CMS vulnerable to info disclosure. The config file exposes plaintext admin credentials, enabling template injection for RCE. Cracked database hashes grant SSH access. Privilege escalation is achieved via apport-cli, run as root.

SH∆FIQ∆IM∆N

February 16, 2025

1 min read

ffuf ffuf-vhost gobuster joomla! php-reverse-shell mysql hashcat apport-cli CVE-2023-1326 CVE-2023-26604 CVE-2023-23752

HackTheBox - Manager Writeup

Manager is a medium-difficulty Hack The Box Windows machine set in an Active Directory environment with AD CS, a web server, and MSSQL. Initial access is gained via RID cycling and password spraying, followed by exploiting xp_dirtree to discover a web backup containing reused credentials. These are used for WinRM access, and privilege escalation is achieved via AD CS ESC7.

SH∆FIQ∆IM∆N

February 9, 2025

1 min read

ldap ldaps ldap-secure ldapsearch kerberos kerbrute kerbrute-userenum mssql crackmapexec-mssql impacket-mssqlclient xp_dirtree xp_dirtree-traverse responder.py steal-NTLMv2 NTLMv2 evil-winrm adcs-esc7 certify certipy-ad manageCA rubeus psexec.py psexec-hash

HackTheBox - Surveillance Writeup

Surveillance is a medium-difficulty Linux machine featuring Craft CMS [CVE-2023-41892] PHP object injection for initial access. Privilege escalation involves authenticated RCE in ZoneMinder and a sudo misconfiguration using LD_PRELOAD, leading to root access.

SH∆FIQ∆IM∆N

February 2, 2025

1 min read

CVE-2023-41892 CVE-2023-26035 gobuster craftcms rce mysql crackstation linpeas chisel zoneminder dpkg check-installed

HackTheBox - Forest Writeup

Forest is an easy Hack The Box Windows Domain Controller with Exchange Server installed. Anonymous LDAP binds allow domain enumeration, revealing a service account with Kerberos pre-authentication disabled. Cracking its hash grants a foothold. As a member of the Account Operators group, the user can add accounts to privileged Exchange groups. This access is leveraged to gain DCSync privileges and dump NTLM hashes, resulting in full domain compromise.

SH∆FIQ∆IM∆N

February 27, 2024

1 min read

ldapsearch GetNPUsers.py rpcclient ASREPRoast evil-winrm bloodhound account-operators-group writedacl powerview.ps1 secretsdump.py DCSync-attack psexec.py psexec-hash hashcat kerberos sharphound ldap

HackTheBox - Pilgrimage Writeup

Pilgrimage is an easy Hack The Box Linux machine with a web app exposing a Git repository. Source code analysis reveals a vulnerable ImageMagick version, allowing arbitrary file read via a crafted PNG. This exposes a SQLite DB with SSH credentials. Privilege escalation is achieved by exploiting CVE-2022-4510 in a root-executed Binwalk script, resulting in root RCE.

SH∆FIQ∆IM∆N

November 25, 2023

1 min read

CVE-2022-44268 CVE-2022-4510 git-dumper pngcrush exiftool binwalk pspy

HackTheBox - MonitorsTwo Writeup

MonitorsTwo is an easy Hack The Box Linux machine featuring pre-auth RCE via a malicious X-Forwarded-For header, leading to a Docker container shell. A misconfigured SUID capsh binary grants root in the container. Cracked MySQL credentials allow SSH access to the host. Privilege escalation is achieved by exploiting Docker CVE-2021-41091 to access container-mounted files and reuse a SUID Bash binary.

SH∆FIQ∆IM∆N

September 3, 2023

1 min read

CVE-2022-46169 CVE-2021-41091 upgrade-shell-using-script rce GTFOBins capsh mysql john docker

HackTheBox - Busqueda Writeup

Busqueda is an easy Hack The Box Linux machine involving command injection in a Python module for initial access. Credentials found in a Git config file provide access to a local Gitea instance. A system checkup script with root permissions exposes Docker container credentials for the Gitea admin. Abusing a relative path vulnerability in the script leads to root RCE and full privilege escalation.

SH∆FIQ∆IM∆N

July 8, 2023

1 min read

python mysql gitea rce searchor 2.4.0 docker docker-inspect

HackTheBox - Sunday Writeup

Sunday is an easy Hack The Box Linux machine with unusual services. Enumeration of the finger service reveals valid usernames, and default credentials provide SSH access. A leaked shadow.backup file exposes a crackable password hash, leading to a second user. With full sudo rights, privilege escalation is achieved by exploiting wget to modify the sudoers file and gain root access.

SH∆FIQ∆IM∆N

December 3, 2022

1 min read

finger finger-user-enum john privesc-wget

HackTheBox - Valentine Writeup

Valentine is an easy Hack The Box Linux machine vulnerable to Heartbleed (CVE-2014-0160). Nmap reveals SSH, HTTP, and HTTPS services, with a clue to Heartbleed in the SSL cert. Exploiting the vulnerability leaks memory contents containing a base64-encoded passphrase. This decrypts an SSH private key, granting access as hype. Privilege escalation is achieved via an exposed tmux session, leading to root.

SH∆FIQ∆IM∆N

November 20, 2022

1 min read

gobuster heartbleed CVE-2014-0160 tmux-session ssh-no-mutual-signature-supported