2026-01-15 5 min
[writeup]
Hack The Box Broker Writeup (Easy Linux)
Easy Linux box. admin:admin opens Apache ActiveMQ 5.15.15, CVE-2023-46604 in OpenWire returns a shell, and sudo nginx writes root's authorized_keys.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2026-01-14 9 min
[writeup]
OffSec Proving Grounds AuthBy Writeup
Windows target. Anonymous FTP names admin, hydra guesses its password, the .htpasswd hash cracks to offsec, and JuicyPotato turns a PHP webshell into SYSTEM.
2026-01-10 5 min
[writeup]
OffSec Proving Grounds Astronaut Writeup
Linux target. An unauthenticated YAML write in Grav CMS 1.10.7 gives a shell as www-data, and the intended root is a SUID php binary straight out of GTFOBins.
2026-01-10 4 min
[writeup]
OffSec Proving Grounds Twiggy Writeup
Linux Proving Grounds box. A salt-api 3000 on port 8000 is vulnerable to CVE-2020-11651, letting an attacker write root's authorized_keys for an SSH login.
2026-01-10 4 min
[writeup]
OffSec Proving Grounds Exfiltrated Writeup
Linux target. Subrion CMS 4.2.1 falls to admin:admin and an arbitrary file upload, then a root cron running exiftool 11.88 executes a malicious DjVu image.