2024-01-25 3 min
[writeup]
TryHackMe Watcher Writeup (Linux)
Linux room. An LFI in post.php leaks FTP credentials, an uploaded PHP shell starts a chain through toby, mat and will, and an adm backup holds root's key.
tail -f /var/log/hos
retired boxes, exploit notes, tooling we wrote because nothing else did the job.
324
posts
11
authors
weekly
cadence
grep all HackTheBox OSCP Preparation Privilege Escalation Linux Web Windows RCE Easy Active Directory Information Disclosure SSH Medium
> latest
2024-01-25 6 min
[writeup]
Hack The Box Bizness Writeup (Easy Linux)
Easy Linux box. Apache OFBiz 18.12 falls to CVE-2023-51467 for a shell, and the Derby database's admin hash cracks against a rebuilt OFBiz routine.
2024-01-25 3 min
[writeup]
Hack The Box OnlyForYou Writeup (Medium Linux)
Medium Linux box. Command injection in the contact form gives a shell, Cypher injection against neo4j leaks john's hash, and sudo pip3 download runs as root.
2024-01-25 3 min
[writeup]
ZoneMinder RCE and zmupdate.pl Root Escalation
Short lab note. An SSH port forward reaches ZoneMinder, the snapshots Metasploit module returns a shell, and sudo zmupdate.pl runs a script as root.
2024-01-25 6 min
[writeup]
Hack The Box Codify Writeup (Easy Linux)
Easy Linux box. A vm2 sandbox escape in the Codify editor gives a shell as svc, a cracked hash from tickets.db gives joshua, and a wildcard compare gives root.