2025-12-16 7 min
[writeup]
Hack The Box Jeeves Writeup (Medium Windows)
Medium Windows box. An open Jenkins script console on port 50000 gives a shell as kohsuke, and SeImpersonatePrivilege with JuicyPotato yields SYSTEM.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-12-15 6 min
[writeup]
Hack The Box Bastard Writeup (Medium Windows)
Medium Windows box. Drupal 7.54 on IIS gives RCE through its Services module, and an unpatched Server 2008 falls to the MS15-051 local exploit for SYSTEM.
2025-12-15 7 min
[writeup]
Hack The Box Conversor Writeup (Easy Linux)
Easy Linux box. The XSLT parser is left unhardened, so a stylesheet writes a Python file into a cron directory, and sudo needrestart hands over root.
2025-12-14 17 min
[writeup]
Hack The Box Soulmate Writeup (Easy Linux)
Easy Linux box. CVE-2025-31161 bypasses CrushFTP auth, a mounted webroot takes a PHP shell, and CVE-2025-32433 in Erlang SSH sets the SUID bit on /bin/bash.
2025-12-13 7 min
[writeup]
Hack The Box Remote Writeup (Easy Windows)
Easy Windows box. A public NFS share holds Umbraco.sdf, whose SHA1 admin hash cracks to baconandcheese, and the authenticated Umbraco RCE leads to SYSTEM.