Posts tagged with

crackstation

HackTheBox - UnderPass Writeup

Underpass is an easy Linux machine on Hack The Box. It involves SNMP enumeration to discover a Daloradius panel with default credentials. From there, a crackable user hash leads to SSH access. Privilege escalation is achieved via mosdh-server, allowing root access.

S SH∆FIQ∆IM∆N
May 14, 2025
1 min read

snmp snmpwalk daloradius daloradius-default-creds crackstation mosh mosh-server
HackTheBox - Chemistry Writeup

Chemistry is an easy Hack The Box Linux machine highlighting RCE in the pymatgen library (CVE-2024-23346) via a malicious CIF file upload. Cracked credentials allow SSH access as rosa. Privilege escalation is achieved by exploiting a path traversal in AioHTTP (CVE-2024-23334) for arbitrary file read, revealing the root flag.

S SH∆FIQ∆IM∆N
March 9, 2025
1 min read

ssh-port-forward sqlite-dump CVE-2024-23346 CVE-2024-23334 aiohttp-3.9.1 crackstation lfi rce cif-file
HackTheBox - Surveillance Writeup

Surveillance is a medium-difficulty Linux machine featuring Craft CMS [CVE-2023-41892] PHP object injection for initial access. Privilege escalation involves authenticated RCE in ZoneMinder and a sudo misconfiguration using LD_PRELOAD, leading to root access.

S SH∆FIQ∆IM∆N
February 2, 2025
1 min read

CVE-2023-41892 CVE-2023-26035 gobuster craftcms rce mysql crackstation linpeas chisel zoneminder dpkg check-installed
HackTheBox - Vaccine Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
July 21, 2021
1 min read

sqlmap sql-union sqli GTFOBins ftp rce zip2john john crackstation python PostgreSQL