2025-03-30 13 min
[writeup]
Hack The Box Bastion Writeup (Easy Windows)
Easy Windows box. A guest readable Backups share holds a VHD, secretsdump pulls bureaulampje from its hives, and mRemoteNG gives up the Administrator.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2025-03-28 19 min
[writeup]
Hack The Box Vintage Writeup (Hard Windows)
Hard Windows AD box. A pre-Windows 2000 computer account yields a gMSA password, an AS-REP roast cracks svc_sql, and DPAPI plus RBCD reach Domain Admin.
2025-03-17 20 min
[writeup]
Hack The Box Heal Writeup (Medium Linux)
Medium Linux box. An LFI in the Rails API leaks a SQLite database, ralph's hash cracks, LimeSurvey 6.6.4 gives RCE, and a local Consul API hands over root.
2025-03-10 17 min
[writeup]
Hack The Box Dog Writeup (Easy Linux)
Easy Linux box. An exposed .git directory leaks the Backdrop CMS database password, an authenticated 1.27.1 RCE gives a shell, and sudo bee eval grants root.
2025-02-20 5 min
[writeup]
Hack The Box Sauna Writeup (Easy Windows)
Easy Windows AD box. Names on /about.html build a username list, AS-REP roasting cracks fsmith, and winpeas finds autologon credentials for svc_loanmanager.