2026-01-20 5 min
[writeup]
OffSec Proving Grounds Hub Writeup (FuguHub RCE)
FuguHub 8.1 still has its admin account unclaimed, so registering it and running the CVE-2023-24078 exploit uploads a Lua .lsp shell that runs as root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-19 11 min
[writeup]
OffSec Proving Grounds Hepet Writeup (Windows)
Windows box. Names off the team page brute force IMAP, a LibreOffice macro mailed to mailadmin lands a shell, and swapping VeyonService gives SYSTEM.
2026-01-18 3 min
[writeup]
OffSec Proving Grounds Access Writeup
Windows AD Proving Grounds box. A .htaccess trick uploads a PHP shell, kerberoast cracks svc_mssql, and SeManageVolume plus WerTrigger gives SYSTEM.
2026-01-17 3 min
[writeup]
OffSec Proving Grounds Squid Writeup (Windows)
Windows box. An open Squid proxy reaches an internal WampServer, phpMyAdmin writes a webshell with INTO OUTFILE, and GodPotato turns that into SYSTEM.
2026-01-17 4 min
[writeup]
OffSec Proving Grounds DVR4 Writeup
Windows Proving Grounds box. Argus Surveillance DVR directory traversal reads viewer's SSH key, and its weak password encryption gives Administrator.