2025-09-24 12 min
[writeup]
Hack The Box RetroTwo Writeup
An MS Access database cracked with office2john leaks LDAP credentials, Timeroasting cracks computer accounts, and Perfusion roots a Server 2008 host.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-09-23 1 min
[writeup]
Hack The Box Manage Writeup
Java RMI on 2222 dumps Tomcat credentials for RCE, a backup directory leaks SSH keys and a TOTP secret, and a sudo adduser rule creates a user named admin.
2025-09-22 19 min
[writeup]
Hack The Box Forgotten Writeup
Easy Linux box. LimeSurvey exploitation via a malicious plugin upload gives RCE, and a shared mount point is used to escape the container onto the host.
2025-09-20 8 min
[writeup]
Hack The Box Down Writeup
An is-it-down app passes URLs to curl unsanitized, giving file:// reads and argument injection, then a brute-forced pswm vault and the sudo group give root.
2025-09-19 10 min
[writeup]
Hack The Box Baby Writeup
LDAP leaks a password in a description field, a spray finds an account forced to change it, and SeBackupPrivilege dumps NTDS.dit for the Administrator hash.