2025-10-22 6 min
[writeup]
Hack The Box Squashed Writeup (Easy Linux)
Easy Linux box. NFS exports with no squashing let a matching local UID drop a webshell, and ross's .Xauthority screenshots an unlocked KeePassXC vault.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-10-21 7 min
[writeup]
Hack The Box Breach Writeup (Medium Windows)
Medium Windows AD box. A writable SMB share and Responder capture julia.wong's hash, Kerberoasting gives svc_mssql, and a silver ticket leads to Administrator.
2025-10-21 5 min
[writeup]
Hack The Box Wifinetic Writeup (Easy Linux)
Easy Linux box. An OpenWrt backup on anonymous FTP leaks a WPA key reused for SSH, and a WPS pixie dust attack with Reaver recovers the root password.
2025-10-21 3 min
[writeup]
Hack The Box Return Writeup (Easy Windows)
Easy Windows AD box. The printer panel binds to any LDAP server, so Responder catches svc-printer in cleartext, and Server Operators turns that into SYSTEM.
2025-10-21 5 min
[writeup]
Hack The Box Antique Writeup (Easy Linux)
Easy Linux box. SNMP leaks the JetDirect telnet password as hex, its exec command returns a shell as lp, and CVE-2012-5519 in CUPS reads any file as root.