2024-03-20 8 min
[writeup]
Hack The Box Skyfall Writeup (Insane Linux)
Insane Linux box. A %0a bypass and MinIO CVE-2023-28432 leak admin keys, a Vault OTP logs in as askyy, and a vault-unseal race condition gives root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-03-16 5 min
[writeup]
Hack The Box Registry Writeup (Hard Linux)
Hard Linux box. Default admin:admin on a Docker registry leaks an SSH key, a cracked Bolt CMS hash gives a web shell, and sudo restic exposes root's key.
2024-03-13 7 min
[writeup]
Hack The Box Jarvis Writeup (Medium Linux)
Medium Linux box. SQL injection in room.php gives an os-shell as www-data, a sudo Python script runs commands as pepper, and SUID systemctl gives root.
2024-02-05 3 min
[notes]
Log4Shell Reverse Shell PoC Walkthrough
CVE-2021-44228 end to end: a dockerised vulnerable Java web app, a fake LDAP server, and a JNDI lookup string that returns a reverse shell on Java 8u20.
2024-02-05 9 min
[writeup]
Hack The Box Hawk Writeup (Medium Linux)
Medium Linux box. Anonymous FTP holds an encrypted file that cracks to the Drupal admin password, the PHP filter module runs code, and H2 Console gives root.