// Browse by category

Categories

HackTheBox

Machines, challenges, and Sherlock investigations from HackTheBox.

8 writeups

DevArea is a Linux machine hosting multiple vulnerable services. Initial access is gained through anonymous FTP revealing a JAR file vulnerable to Apache CXF SSRF (CVE-2022-46364), which exposes Hoverfly credentials in systemd service files. The Hoverfly instance is vulnerable to path traversal (CVE-2025-54123), leading to remote code execution. Privilege escalation exploits a world-writable `/bin/bash` binary combined with a passwordless sudo rule, allowing arbitrary command execution as root.

Mar 2026

HTBEASY

facts

Facts is a medium-difficulty machine that revolves around exploiting a vulnerable CMS hosted on facts.htb. Initial enumeration reveals multiple exposed services, including a web application and SSH. The key to gaining access lies in a path traversal vulnerability within the CMS, allowing authenticated users to download sensitive files. By leveraging this flaw, we can retrieve the SSH private key for the 'trivia' user, crack it, and gain initial access. From there, we can escalate privileges using a misconfigured sudo permission on the 'facter' command.

Jan 2026

HTBMEDIUM

gavel

Gavel is a medium-difficulty Linux machine that demonstrates the exploitation of a misused SQL PDO statement to achieve SQL injection and extract data from an internal database. The scenario further highlights a PHP code-injection flaw that is exploited to execute remote commands, thereby enabling initial access to the target. Privilege escalation is achieved by targeting a root-owned daemon that processes user-supplied YAML files; by submitting a crafted YAML payload, PHP code is executed within a sandboxed environment with root privileges.

Nov 2025

HTBHARD

Fries

Fries is a hard Active Directory machine on Hack The Box. It involves various techniques such as LDAP enumeration, Kerberos attacks, and SMB exploitation to gain access to the system and escalate privileges to root.

Nov 2025

HTBHARD

Nanocorp

Nanocorp is a Hard difficulty Active Directory machine that exploits CVE-2025-24054 to extract NTLM hashes via malicious .library-ms files. After gaining initial access and password cracking, privilege escalation is achieved through a Check MK Agent vulnerability by crafting a malicious MSI repair payload to execute code as SYSTEM.

MonitorsFour is an Active Directory machine on Hack The Box that features a vulnerable API endpoint leading to credential leakage, followed by an authenticated RCE in Cacti, and ultimately a full Docker escape via SSRF to achieve host compromise.

Nov 2025

HTBEASY

Giveback

Giveback starts with a WordPress website with a donation plugin that’s vulnerable to a RCE exploit. I’ll get a shell in a Kubernetes pod, and use it to scan an internal legacy app running PHP-CGI. I’ll abuse a vulnerability in that application to get to the next pod, where I’ll find a Kubernetes secret to interact with the API and dump secrets. I’ll use an SSH password to get on the host. For root I’ll abuse a custom wrapper around runc two different ways.

Nov 2025

TryHackMe

Rooms and paths from TryHackMe.

70 writeups

TryHackMe: Contrabando

Aug 2025

THM

TryHackMe: Soupedecode 01

TryHackMe: Crypto Failures

Mar 2025

THM

TryHackMe: Rabbit Store

Feb 2025

THM

TryHackMe: Decryptify

Feb 2025

THM

TryHackMe: You Got Mail

Feb 2025

THM

TryHackMe: TryPwnMe Two

TryHackMe: Silver Platter

Jan 2025

THM

TryHackMe: AoC 2024 Side Quest Two

Jan 2025

THM

TryHackMe: AoC 2024 Side Quest Three

Jan 2025

THM

TryHackMe: AoC 2024 Side Quest One

Jan 2025

THM

TryHackMe: AoC 2024 Side Quest Four

Jan 2025

THM

TryHackMe: AoC 2024 Side Quest Five

Jan 2025

THM

TryHackMe: The Sticker Shop

TryHackMe: Mouse Trap

TryHackMe: Rabbit Hole

Oct 2024

THM

TryHackMe: Mountaineer

TryHackMe: The London Bridge

Sep 2024

THM

TryHackMe: Cheese CTF

TryHackMe: CERTain Doom

Sep 2024

THM

TryHackMe: TryPwnMe One

TryHackMe: U.A. High School

TryHackMe: DX2: Hell's Kitchen

Jul 2024

THM

TryHackMe: New York Flankees

Jul 2024

THM

TryHackMe: NanoCherryCTF

TryHackMe: Whats Your Name?

Apr 2024

THM

TryHackMe: TriCipher Summit

Apr 2024

THM

TryHackMe: Burg3r Bytes

TryHackMe: El Bandito

Mar 2024

THM

TryHackMe: Hack Smarter Security

TryHackMe: Breaking RSA

PortSwigger Academy

SQL injection, XSS, SSRF, deserialization, auth bypasses.

0 writeups

Root Me

Buffer overflows, ROP chains, heap exploitation, format strings.

0 writeups