2025-09-18 6 min
[writeup]
Hack The Box VulnEscape Writeup
Only RDP is exposed. Disabling NLA reveals kiosk credentials, cmd.exe renamed to msedge bypasses UAC, and a Remote Desktop Plus profile decrypts to admin.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-09-18 5 min
[writeup]
Hack The Box Lock Writeup
A Gitea API key in git history opens a private repo with CI/CD, a webshell push lands a foothold, and PDF24 MSI repair with an oplock gives SYSTEM.
2025-09-17 2 min
[notes]
Memory Manipulation 2: RCE root no Android com Frida
Reversing do APK do BEERUS no JADX e um hook em Frida que transforma a compactação da sandbox em execução de comando como root.
2025-09-17 12 min
[writeup]
Hack The Box Retro Writeup (Easy Windows)
Easy Windows AD box. A bogus username gets guest access, the Trainees share leaks trainee:trainee, and a pre2k computer account turns ESC1 into domain admin.
2025-09-16 3 min
[notes]
Enable token privileges without writing the script to disk
Fetch a Base64 blob, decode it in memory and light up SeDebug and friends, without ever dropping a .ps1 for the EDR to find.