Posts tagged with

hashcat

HackTheBox - Topology Writeup

Topology is an easy Hack The Box Linux machine featuring a vulnerable LaTeX web app with a Local File Inclusion (LFI) flaw. The LFI exposes an .htpasswd file containing a crackable hash, leading to SSH access. Privilege escalation is achieved via a root cronjob that executes malicious gnuplot files.

S SH∆FIQ∆IM∆N
March 30, 2025
1 min read

latex formula .htpasswd hashcat gnuplot pspy ffuf-vhost
HackTheBox - Active Writeup

Active is an easy Hack The Box Windows machine set in an Active Directory environment. Anonymous SMB access reveals a Groups.xml file with a GPP-encrypted password, leading to domain credentials and the user flag. Kerberoasting a user with an SPN yields a crackable TGS hash, granting Administrator access via PsExec and full system compromise.

S SH∆FIQ∆IM∆N
March 23, 2025
1 min read

smb smbmap smbclient-ng groups.xml group-policy-file gpp-decrypt ldap ldapsearch impacket-GetADUsers kerberoasting ldapsearch-SPN hashcat impacket-psexec kerberos
HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Codify Writeup

Codify is an easy Hack The Box Linux machine featuring a Node.js code execution app using a vulnerable vm2 library, allowing RCE. A SQLite database reveals a crackable hash, granting SSH access. Privilege escalation is achieved via a misconfigured Bash script that exposes the root password.

S SH∆FIQ∆IM∆N
March 2, 2025
1 min read

nodejs vm2 vm2-v3.9.16 hashcat wildcard-injection pspy
HackTheBox - CozyHosting Writeup

CozyHosting is an easy Hack The Box Linux machine running a Spring Boot app with exposed Actuator endpoints. Session hijacking grants dashboard access, and a command injection vulnerability provides a reverse shell. Hardcoded credentials in the JAR file reveal a database hash, which, once cracked, allows SSH access as josh. The user can run ssh as root, leading to full privilege escalation.

S SH∆FIQ∆IM∆N
February 23, 2025
1 min read

spring-boot-error spring-boot gobuster PostgreSQL hashcat GTFOBins
HackTheBox - Devvortex Writeup

Devvortex is an easy Hack The Box Linux machine running Joomla CMS vulnerable to info disclosure. The config file exposes plaintext admin credentials, enabling template injection for RCE. Cracked database hashes grant SSH access. Privilege escalation is achieved via apport-cli, run as root.

S SH∆FIQ∆IM∆N
February 16, 2025
1 min read

ffuf ffuf-vhost gobuster joomla! php-reverse-shell mysql hashcat apport-cli CVE-2023-1326 CVE-2023-26604 CVE-2023-23752
HackTheBox - Forest Writeup

Forest is an easy Hack The Box Windows Domain Controller with Exchange Server installed. Anonymous LDAP binds allow domain enumeration, revealing a service account with Kerberos pre-authentication disabled. Cracking its hash grants a foothold. As a member of the Account Operators group, the user can add accounts to privileged Exchange groups. This access is leveraged to gain DCSync privileges and dump NTLM hashes, resulting in full domain compromise.

S SH∆FIQ∆IM∆N
February 27, 2024
1 min read

ldapsearch GetNPUsers.py rpcclient ASREPRoast evil-winrm bloodhound account-operators-group writedacl powerview.ps1 secretsdump.py DCSync-attack psexec.py psexec-hash hashcat kerberos sharphound ldap
HackTheBox - Responder Writeup

Responder is a free starting-point machine. This machine teaches us how to use the responder utility to steal the password hash and crack it with hashcat. On top of that, this machine is also vulnerable to local file inclusion. Which we can exploit through log poisoning to gain remote code execution and get the reverse shell.

S SH∆FIQ∆IM∆N
April 9, 2022
1 min read

lfi rce log-poisoning responder.py NTLMv2 hashcat reverse-powershell php-webshell evil-winrm steal-NTLMv2
HackTheBox - Guard Writeup

Starting Point Machine

S SH∆FIQ∆IM∆N
August 8, 2021
1 min read

rbash hashcat bypass-rbash