Posts tagged with

msfvenom

HackTheBox - Sauna Writeup

Sauna is an easy Hack The Box Windows machine focused on Active Directory exploitation. Usernames are gathered from a company site and used in an ASREPRoasting attack, revealing a crackable hash. The recovered credentials enable WinRM access. WinPEAS uncovers autologon credentials for another user, who has remote access and DCSync privileges. A successful DCSync attack retrieves the domain admin hash, which is used with Impacket’s psexec.py for SYSTEM access.

S SH∆FIQ∆IM∆N
March 16, 2025
1 min read

ldap ldapsearch username-anarchy crackmapexec-smb ASREPRoast GetNPUsers.py evil-winrm bloodhound sharphound printnightmare printer DCSync-attack winpeas secretsdump.py psexec.py psexec-hash hashcat msfvenom kerberos CVE-2021-1675 CVE-2021-34527
HackTheBox - Arctic Writeup

Arctic is an easy Hack The Box Windows machine featuring a vulnerable Adobe ColdFusion server. Initial access is gained via an unauthenticated file upload exploit. After obtaining a reverse shell, privilege escalation is achieved using the MS10-059 vulnerability, resulting in full system compromise.

S SH∆FIQ∆IM∆N
October 8, 2022
1 min read

CVE-2009-2265 juicy-potato seImpersonatePrivilege coldfusion rce smbserver.py upload-vuln lfi jsp-reverse-shell msfvenom
HackTheBox - Jerry Writeup

Jerry is an easy Windows machine focused on exploiting Apache Tomcat, allowing attackers to gain a NT AUTHORITY\SYSTEM shell and fully compromise the system.

S SH∆FIQ∆IM∆N
June 4, 2022
1 min read

msfvenom jsp-reverse-shell jsp-webshell war-file apache-tomcat
HackTheBox - Love Writeup

Love is an easy Windows machine featuring a vulnerable voting system web application. Initial enumeration reveals a service on port 5000, but direct access is denied. A secondary file scanner service is found to be vulnerable to SSRF, which is exploited to access an internal password manager. Credentials obtained from this allow authentication to the voting system, which is vulnerable to authenticated Remote Code Execution. This grants access as the phoebe user. Post-exploitation reveals AppLocker is enabled, but a misconfiguration allows privilege escalation by deploying a malicious .msi file, resulting in a shell as SYSTEM.

S SH∆FIQ∆IM∆N
August 25, 2021
1 min read

ssrf upload-vuln AlwaysInstallElevated winpeas msfvenom gobuster msi-file