2026-01-16 11 min
[writeup]
OffSec Proving Grounds Kevin Writeup
Windows 7 target running HP Power Manager 4.2. The admin/admin default login confirms the version, and a formExportDataLogs overflow returns a SYSTEM shell.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-16 4 min
[writeup]
OffSec Proving Grounds Jacko Writeup
Windows Proving Grounds box. A passwordless H2 1.4.199 console runs JNI code execution for a shell as tony, and SeImpersonate with GodPotato gives SYSTEM.
2026-01-16 4 min
[writeup]
OffSec Proving Grounds Resourced Writeup
Windows AD target. A null session reads a password out of a user description, a shared NTDS.dit dumps every hash, and RBCD impersonates Administrator.
2026-01-15 8 min
[writeup]
OffSec Proving Grounds Internal Writeup
Windows Server 2008 SP1 target with nothing usable exposed but SMB. AutoBlue's MS17-010 EternalBlue exploit with the x86 shellcode returns a SYSTEM shell.
2026-01-15 5 min
[writeup]
OffSec Proving Grounds Hutch Writeup (Windows)
Windows PG box. Anonymous LDAP leaks a password in a user description, WebDAV takes an aspx webshell, and the same account reads the LAPS admin password.