2024-01-25 5 min
[writeup]
Hack The Box PC Writeup (Easy Linux)
Easy Linux box. A gRPC service on 50051 hands sqlmap a SQLite injection, the sau password opens SSH, and pyLoad on 8000 runs an unauthenticated RCE as root.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-01-25 3 min
[writeup]
TryHackMe Wekor Writeup (WordPress and Memcached)
SQLi in the it-next cart dumps the WordPress users, a 404.php shell lands www-data, memcached leaks Orka's password, and a sudo script gives root.
2024-01-25 6 min
[writeup]
TryHackMe Harder Writeup
A PHP hash_hmac type juggling bypass and an X-Forwarded-For check get you a shell, then a PATH hijack in a setuid wrapper rewrites /etc/shadow for root.
2024-01-25 3 min
[writeup]
TryHackMe Plotted-EMR Writeup
TryHackMe Linux box. A passwordless MySQL admin reconfigures OpenEMR 5.0.1.3 for authenticated RCE, then an rsync wildcard cron and perl cap_fowner give root.
2024-01-25 7 min
[writeup]
TryHackMe Borderlands Writeup (BGP Hijacking)
Linux room. GitTools dumps an exposed .git for an API key, sqlmap turns documentid into an OS shell, and pivoting reaches a vsftpd 2.3.4 backdoor and BGP.