2025-10-01 103 min
[research]
TryHackMe Wreath Writeup: pivoting a three host network
A full black-box red team engagement against the TryHackMe Wreath network: GitStack RCE, pivoting through three hosts, an unquoted service path and C2.
TH
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-09-29 12 min
[writeup]
Hack The Box Delegate Writeup
SYSVOL leaks a credential, GenericWrite enables a targeted Kerberoast, and SeEnableDelegationPrivilege stages a PrinterBug coercion that ends in DCSync.
2025-09-28 9 min
[writeup]
Hack The Box BabyTwo Writeup
Guest SMB and a username-as-password spray get credentials, a writable SYSVOL logon script gives a shell, and WriteOwner over gpoadm ends in pyGpoAbuse.
2025-09-27 11 min
[writeup]
Hack The Box Data Writeup
Easy Linux box. Grafana path traversal (CVE-2021-43798) reads the SQLite database, bcrypt hashes fall to Hashcat, and a privileged Docker container escapes.
2025-09-26 7 min
[writeup]
Hack The Box Reset Writeup
A password reset endpoint returns the new password, LFI plus log poisoning gives a shell, and rsh trust files lead to sadm and a GTFOBins nano escape.