2025-12-04 11 min
[writeup]
Hack The Box OpenSource Writeup (Easy Linux)
Easy Linux box. A git commit leaks dev01 credentials, encoded path traversal reaches the Werkzeug PIN, and a root git-sync job runs a rogue pre-commit hook.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-12-03 11 min
[writeup]
Hack The Box MetaTwo Writeup (Easy Linux)
Easy Linux box. CVE-2022-0739 in BookingPress dumps WordPress hashes, an XXE in WordPress 5.6.2 reads wp-config.php, and a cracked passpie key gives root.
2025-11-30 20 min
[writeup]
Hack The Box Guardian Writeup (Hard Linux)
Hard Linux box. A default password opens the student portal, an IDOR leaks Gitea creds, a PhpSpreadsheet XSS steals a lecturer session, and sudo gives root.
2025-11-28 9 min
[writeup]
Hack The Box NodeBlog Writeup (Easy Linux)
Easy Linux box. A NoSQL $ne login bypass opens the admin panel, XXE in the XML upload leaks server.js, and unserialize on the auth cookie gives a shell.
2025-11-27 4 min
[writeup]
Hack The Box Delivery Writeup (Easy Linux)
Easy Linux box. A Mattermost internal channel leaks SSH credentials, and hashcat rules turn the mattermost root hash into the system root password.