2025-05-11 31 min
[writeup]
Hack The Box Reel Writeup
Hard Windows AD box. An SMTP service accepts weaponized RTF attachments for initial access, then BloodHound maps misconfigured ACLs through to Domain Admin.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-05-01 31 min
[writeup]
Hack The Box Rabbit Writeup
Insane Windows AD box. OWA credential spraying opens a mailbox, a LibreOffice macro captures Net-NTLMv2, and Wamp misconfigs lead to domain compromise.
2025-04-23 25 min
[writeup]
Hack The Box Mantis Writeup
Hard Windows AD box. Orchard CMS credentials come out of a MSSQL database found by connection string discovery, then MS14-068 forges a PAC to Domain Admin.
2025-04-20 25 min
[writeup]
Hack The Box Sizzle Writeup
Insane Windows AD box. LLMNR poisoning steals NTLM hashes, ADCS issues a cert for PSRemoting, Kerberoasting cracks a service account, DCSync ends it.
2025-04-06 3 min
[writeup]
Hack The Box Craft Writeup (Medium Linux)
Medium Linux box. Enumeration notes: nginx on 443 with a craft.htb certificate, a Go SSH service on port 6022, and vhost fuzzing that turns up api and vault.