2024-02-02 4 min
[writeup]
Hack The Box Authority Writeup (Medium Windows)
Medium Windows AD box. An open SMB share hides an Ansible vault holding PWM's LDAP creds, and a CorpVPN certificate request becomes the Administrator.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-02-02 5 min
[writeup]
Hack The Box Sunday Writeup (Easy Solaris)
Easy Solaris box. The finger service enumerates sammy and sunny, an SSH brute force cracks sunny, a shadow backup gives sammy, and sudo wget gives root.
2024-01-25 5 min
[writeup]
Hack The Box Stocker Writeup (Easy Linux)
Easy Linux box. A NoSQL injection bypasses the dev.stocker.htb login, HTML to PDF rendering reads local files, and a sudo node wildcard gives root.
2024-01-25 2 min
[writeup]
TryHackMe Bugged Writeup (MQTT Broker)
MQTT room. An open Mosquitto 2.0.14 broker publishes every topic, and a base64 config message reveals the hidden topic pair that runs system commands.
2024-01-25 2 min
[writeup]
Hack The Box BountyHunter Writeup (Easy Linux)
Easy Linux box. The bug report form posts base64 encoded XML, so XXE reads db.php, and that database password is reused for the development user over SSH.