Posts tagged with

HackTheBox - MonitorsTwo Writeup

MonitorsTwo is an easy Hack The Box Linux machine featuring pre-auth RCE via a malicious X-Forwarded-For header, leading to a Docker container shell. A misconfigured SUID capsh binary grants root in the container. Cracked MySQL credentials allow SSH access to the host. Privilege escalation is achieved by exploiting Docker CVE-2021-41091 to access container-mounted files and reuse a SUID Bash binary.

HackTheBox - Validation Writeup

HackTheBox - Unified Writeup

Unified is the new starting point machine that HacktheBox released. This machine heavily focus on new vulnerabilities that had been discussed all across the world. This vulnerability is from the java logging library, Log4J (CVE-2021-44228). How we can exploit the Unifi application, especially version 6.4.54 with using the Rogue-JNDI application. Which is a malicious server that allows us to receive the connection and do some nasty injections.