2024-04-09 5 min
[writeup]
Hack The Box IClean Writeup (Medium Linux)
Medium Linux box. Blind XSS steals the admin session cookie, a Jinja2 SSTI in the QR generator gives a shell, and sudo qpdf reads any file as root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-04-04 3 min
[writeup]
Hack The Box WifineticTwo Writeup (Medium Linux)
Medium Linux box. Default creds and OpenPLC CVE-2021-31630 give RCE, then a WPS pixie dust attack joins plcrouter and SSHes to the gateway as root.
2024-03-26 3 min
[writeup]
Hack The Box Monitors Writeup (Hard Linux)
Hard Linux box. A WordPress plugin LFI leaks wp-config, Cacti 1.2.12 gives a shell, and an internal Apache OFBiz on 8443 gives root inside a container.
2024-03-25 3 min
[writeup]
Hack The Box Headless Writeup (Easy Linux)
Easy Linux box. Blind XSS in the support form steals the admin cookie, the dashboard date field injects commands, and sudo syscheck runs a planted initdb.sh.
2024-03-22 8 min
[writeup]
Hack The Box FormulaX Writeup (Hard Linux)
Hard Linux box. Blind XSS steals the admin chatbot history, a simple-git RCE gives a shell, and LibreOffice UNO over sudo sets the SUID bit on bash.