2025-10-12 17 min
[writeup]
Hack The Box UpDown Writeup (Medium Linux)
Medium Linux box. An exposed .git leaks a Special-Dev header, a zipped PHP shell renamed .txt runs through phar://, and sudo easy_install gives root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-10-10 13 min
[writeup]
Hack The Box Phantom Writeup (Medium Windows)
Medium Windows AD box. An SMB email leaks the onboarding password, a VeraCrypt backup gives up svc_sspr, and RBCD on an SPN-less user reaches Administrator.
2025-10-09 15 min
[writeup]
Hack The Box Escape Writeup
Medium Windows AD box. MSSQL leaks NTLMv2 through xp_dirtree, SQL Server logs hold plaintext credentials, and ADCS ESC1 impersonates the domain admin.
2025-10-03 28 min
[writeup]
Hack The Box Job Writeup
Easy Windows box. Phishing with a malicious LibreOffice macro lands a foothold, an IIS web shell gives RCE, and token impersonation escalates to SYSTEM.
2025-10-02 14 min
[writeup]
Hack The Box Sendai Writeup (Medium Windows)
Medium Windows AD box. Guest SMB leaks reset accounts, kpasswd claims one, GenericAll on ADMSVC reads a GMSA hash, and an ESC4 template hijack gives DA.