Posts tagged with

ffuf-vhost

HackTheBox - LinkVortex Writeup

LinkVortex is an easy Linux machine on Hack The Box that showcases symlink exploitation. It begins by dumping an exposed .git directory to access Ghost CMS, which is vulnerable to CVE-2023-40028. This flaw allows authenticated symlink uploads to read arbitrary files inside the container, exposing host credentials. Privilege escalation is achieved via a sudo script vulnerable to a chained symlink technique, leading to full root access.

S SH∆FIQ∆IM∆N
April 28, 2025
1 min read

ghost ghost-v5.58 ffuf-vhost git-dumper CVE-2023-40028 chained-symlink
HackTheBox - Topology Writeup

Topology is an easy Hack The Box Linux machine featuring a vulnerable LaTeX web app with a Local File Inclusion (LFI) flaw. The LFI exposes an .htpasswd file containing a crackable hash, leading to SSH access. Privilege escalation is achieved via a root cronjob that executes malicious gnuplot files.

S SH∆FIQ∆IM∆N
March 30, 2025
1 min read

latex formula .htpasswd hashcat gnuplot pspy ffuf-vhost
HackTheBox - Devvortex Writeup

Devvortex is an easy Hack The Box Linux machine running Joomla CMS vulnerable to info disclosure. The config file exposes plaintext admin credentials, enabling template injection for RCE. Cracked database hashes grant SSH access. Privilege escalation is achieved via apport-cli, run as root.

S SH∆FIQ∆IM∆N
February 16, 2025
1 min read

ffuf ffuf-vhost gobuster joomla! php-reverse-shell mysql hashcat apport-cli CVE-2023-1326 CVE-2023-26604 CVE-2023-23752