2025-11-21 9 min
[writeup]
Hack The Box VulnCicada Writeup
Medium Windows AD box. NFS exposes files that lead to a sprayed foothold, then PetitPotam coerces the DC and ADCS ESC8 issues a certificate good for DCSync.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-11-19 11 min
[writeup]
Hack The Box Shibuya Writeup
Hard Windows AD box from VulnLab. A WIM image exposes SAM hashes, ADCS ESC1 abuses certificates, and RemotePotato0 relays Net-NTLMv2 to take the domain.
2025-11-18 8 min
[writeup]
Hack The Box Academy Writeup
Easy Linux box. A hidden role parameter in a Laravel signup grants admin, CVE-2018-15133 deserialization gives a shell, and sudo Composer escalates to root.
2025-11-15 6 min
[writeup]
Hack The Box SwagShop Writeup (Easy Linux)
Easy Linux box. Magento 1.9.0.0 falls to the Shoplift SQL injection for an admin account, an authenticated RCE gives www-data, and sudo vi gives root.
2025-11-14 11 min
[writeup]
Hack The Box EscapeTwo Writeup (Easy Windows)
Easy Windows AD box. A corrupted xlsx on an SMB share leaks passwords, sa on MSSQL gives a shell, and an ESC4 template hijack mints the Administrator.