2025-11-06 9 min
[writeup]
Hack The Box Alert Writeup (Easy Linux)
Easy Linux box. Stored XSS in the markdown viewer makes the admin read messages.php, path traversal leaks .htpasswd, and a writable config.php gives root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-11-05 7 min
[writeup]
Hack The Box Celestial Writeup (Medium Linux)
Medium Linux box. An Express app deserializes a base64 profile cookie with node-serialize, and a root cron running a writable script.py SUIDs bash.
2025-11-05 6 min
[writeup]
Hack The Box Nunchucks Writeup (Easy Linux)
Easy Linux box. The store subdomain reflects email into a Nunjucks template, SSTI returns a shell as david, and a perl capability gets past AppArmor.
2025-11-01 6 min
[writeup]
Hack The Box Explore Writeup (Easy Android)
Easy Android box. CVE-2019-6447 in ES File Explorer reads creds.jpg off the device, SSH gets in as kristi, and forwarded ADB on 5555 gives root.
2025-10-28 4 min
[writeup]
Hack The Box Sense Writeup (Easy pfSense)
Easy pfSense box. Gobuster finds system-users.txt naming rohit, the company default password logs in, and a graph injection exploit lands a root shell.