2024-05-14 4 min
[writeup]
Hack The Box SolarLab Writeup (Medium Windows)
Medium Windows box. An anonymous SMB share leaks a credentials spreadsheet, a password spray opens ReportHub, and ReportLab CVE-2023-33733 gives RCE.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-04-22 10 min
[writeup]
Hack The Box Runner Writeup (Medium Linux)
Medium Linux box. CVE-2023-42793 on a hidden TeamCity vhost gives RCE, its backup leaks an SSH key and a bcrypt hash, and Portainer mounts the host disk.
2024-04-20 6 min
[writeup]
Hack The Box Jab Writeup (Medium Windows)
Medium Windows AD box. An XMPP user search lists the domain, AS-REP roasting cracks jmontgomery, a chat room leaks svc_openfire, and CVE-2023-32315 is SYSTEM.
2024-04-15 5 min
[writeup]
Hack The Box Usage Writeup (Easy Linux)
Easy Linux box. Blind SQLi in the reset form dumps admin_users, laravel-admin takes a php upload, and a 7za wildcard reads root's SSH private key.
2024-04-12 9 min
[writeup]
Hack The Box Hospital Writeup (Medium Windows)
Medium Windows box. A .phar upload lands in a Linux VM, CVE-2023-2640 gives root and drwilliams, and a GhostScript .eps mailed to drbrown ends as SYSTEM.