2025-11-13 26 min
[writeup]
OffSec Stapler Writeup: WordPress LFI to root
OffSec lab. An LFI in a WordPress plugin leaks wp-config, MySQL file writes plant a web shell, and a password in bash history plus open sudo gives root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-11-11 8 min
[writeup]
Hack The Box Support Writeup (Easy Windows)
Easy Windows AD box. A guest share leaks UserInfo.exe and its LDAP password, the support account's info field holds another, and GenericAll enables DCSync.
2025-11-11 7 min
[writeup]
Hack The Box SteamCloud Writeup (Easy Linux)
Easy Linux box. An unauthenticated Kubelet API lets kubeletctl exec into the nginx pod, whose service account token then creates a pod mounting the host disk.
2025-11-10 6 min
[writeup]
Hack The Box Curling Writeup (Easy Linux)
Easy Linux box. A secret.txt password logs into Joomla for RCE, a nested password_backup unpacks to floris' SSH creds, and a root curl config reads files.
2025-11-10 8 min
[writeup]
Hack The Box GoodGames Writeup (Easy Linux)
Easy Linux box. SQL injection dumps the admin hash, Jinja2 SSTI on a hidden vhost gives root in a container, and a mounted home directory SUIDs bash.