2025-12-22 15 min
[writeup]
Hack The Box Admirer Writeup
Easy Linux box. FTP and robots.txt leak backup archives with credentials, Adminer CVE-2021-43008 reads files, and a SETENV sudo rule hijacks PYTHONPATH.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-12-21 9 min
[notes]
SOC335: CVE-2024-49138 explorada no CLFS do Windows
SOC335 no Let's Defend: detectando a exploração da CVE-2024-49138 no driver CLFS do Windows, do alerta do EDR à escalação de privilégio.
2025-12-20 13 min
[writeup]
Hack The Box Cascade Writeup
Medium Windows AD box. LDAP null-bind finds a VNC password, a .NET assembly gives up an AES key, and a deleted account in the AD Recycle Bin grants admin.
2025-12-18 7 min
[writeup]
Hack The Box Mango Writeup
Medium Linux box. NoSQL injection against a MongoDB login form extracts credentials character by character, and GTFOBins jjs escalates the pivot to root.
2025-12-18 12 min
[writeup]
Hack The Box Magic Writeup
Medium Linux box. SQL injection bypasses the login, a magic-bytes polyglot beats upload validation for RCE, and PATH hijacking on a SUID binary gives root.