Easy Machine Archives - Threatninja.net

3 Oct, 2026

Hack The Box: Reactor Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2025-55182, devtools, HackTheBox, hashcat, Linux, next.js, node, Penetration Testing, port forwarding, react, React2shell, sqlite3, ssh

Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.

The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.

From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.

For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.

I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.

Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …

Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty

12 Sep, 2026

Hack The Box: Silentium Machine Walkthrough – Easy Difficulity

Easy Machine BurpSuite, Challenges, CVE-2025-58434, CVE-2025-8110, Flowise, gobuster, gogs, HackTheBox, Linux, Penetration Testing, port forwarding, ssh, Symlink Attack

Completed another Hack The Box machine, Silentium.

Initial access was achieved by exploiting a password-reset vulnerability in the staging Flowise application, followed by abusing a custom MCP endpoint to obtain a root shell inside the Flowise container. Credentials exposed through the container environment were then used to SSH into the underlying host as ben and retrieve the flag.

For privilege escalation, an internal Gogs instance was discovered through local port forwarding. A malicious symlink was pushed and manipulated through the Gogs API to target /etc/sudoers.d/ben, allowing a passwordless sudo rule to be written and ultimately providing full root access.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #CTF …

Learn MoreHack The Box: Silentium Machine Walkthrough – Easy Difficulity

1 Aug, 2026

Hack The Box: Kobold Machine Walkthrough – Easy Difficulty

Easy Machine Arcane, BurpSuite, Challenges, CVE-2025-64714, CVE-2026-23744, docker, ffuf, gobuster, HackTheBox, Linux, Local File Inclusion (LFI), MCPJam, Penetration Testing, PrivateBin LFI, python3, ssh

Completed the Hack The Box “Kobold” machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation.

The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #Docker #VulnerabilityManagement #CVE #EthicalHacking #CybersecurityLearning …

Learn MoreHack The Box: Kobold Machine Walkthrough – Easy Difficulty

11 Jul, 2026

Hack The Box: CCTV machine walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2024-5148, CVE-2025-60787, HackTheBox, hashcat, Linux, MotionEye, port forwarding, sqlmap, ssh, Zoneminder

Just completed the CCTV machine from Hack The Box!

After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

27 Jun, 2026

Hack The Box: Wingdata Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2025-4517, CVE-2025-47812, HackTheBox, hashcat, Linux, Penetration Testing, python3, ssh

I recently completed the Wingdata machine on Hack The Box! This easy-rated challenge involved exploiting an unauthenticated command injection vulnerability (CVE-2025-47812) in the Wing FTP Server web client to gain initial access as the wingftp user. After enumerating the system and cracking a SHA-256 password hash from a user configuration file using Hashcat, I escalated to the wacky user.

Finally, I leveraged a vulnerable Python backup restoration script by injecting a malicious tarball containing my SSH public key, achieving full root access. A great box for practicing web application exploitation, password cracking, and creative privilege escalation techniques.

#HackTheBox #PenetrationTesting #CyberSecurity #EthicalHacking #PrivilegeEscalation …

Learn MoreHack The Box: Wingdata Machine Walkthrough – Easy Difficulty

6 Jun, 2026

Hack The Box: Facts Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Camaleon CMS, Challenges, CVE-2025-2304, facter, gobuster, gtfobins, HackTheBox, john the ripper, Linux, Penetration Testing, python3, ssh

Completed the Facts machine from Hack The Box, an easy-rated Linux challenge that combined web exploitation, cloud storage enumeration, SSH key recovery, and privilege escalation.

The initial foothold came from exploiting CVE-2025-2304, a mass assignment vulnerability in Camaleon CMS 2.9.0, which allowed privilege escalation from a low-privileged user to administrator. Access to the administration panel exposed S3 configuration details and credentials, leading to enumeration of an internal bucket containing an encrypted SSH private key. After recovering the key’s passphrase with John the Ripper, SSH access as the trivia user was obtained.

Privilege escalation to root involved abusing facter, a Ruby-based utility executable via sudo without a password. By leveraging its –custom-dir option to load a malicious custom fact, arbitrary commands were executed as root, resulting in full system compromise.

A great machine that highlights the impact of insecure parameter handling, cloud storage exposure, and the risks associated with misconfigured sudo privileges.

#HackTheBox #HTB #Facts #CyberSecurity #PenetrationTesting #EthicalHacking #RedTeam #PrivilegeEscalation #Linux #AWS #S3 #CamaleonCMS #CVE20252304 #JohnTheRipper #Ruby #Infosec #CTF #CyberSecurityLearning …

Learn MoreHack The Box: Facts Machine Walkthrough – Easy Difficulty

23 May, 2026

Hack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

Easy Machine BurpSuite, cacti, Challenges, CVE-2025-24367, docker, Docker API Abuse, gobuster, HackTheBox, Linux, Penetration Testing, rustscan, Windows

Wrapped up another solid box with a clean chain from web exploitation to full host compromise.

Gained initial access through an IDOR vulnerability on the /user endpoint, which exposed an admin hash that cracked to wonderful1. This provided access to the Cacti dashboard as marcus. From there, exploiting CVE-2025-24367 led to a reverse shell inside a Docker container as www-data, where the user flag was retrieved.

Privilege escalation came from spotting an exposed Docker API. By deploying a privileged container and mounting the host filesystem, it was possible to break out of the container and access the Windows host, ultimately retrieving the root flag.

Nice reminder of how small web flaws can cascade into full infrastructure compromise when combined with misconfigurations like exposed Docker daemons.

#cybersecurity #penetrationtesting #redteam #docker #privilegeescalation #websecurity #ethicalhacking #infosec …

Learn MoreHack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

11 Apr, 2026

Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity

Easy Machine BadSuccessor.ps1, Challenges, DMSA, evil-winrm, HackTheBox, impacket-getST, Ligolo-ng, mssqlclient, nxc, Penetration Testing, secretdump, Windows

Just completed the Eighteen machine on Hack The Box — a great example of chaining multiple techniques from initial access to full domain compromise.

Gained initial foothold by cracking WinRM credentials (adam.scott / iloveyou1) and accessing the system via Evil-WinRM. From there, escalated privileges by abusing Delegated Managed Service Accounts (DMSA) using BadSuccessor, allowing impersonation of the Administrator.

Set up a Ligolo-ng tunnel to reach the domain controller, leveraged Kerberos ticket abuse with Impacket, and successfully dumped NTDS secrets. This led to extracting the Administrator NTLM hash and achieving full system compromise via Pass-the-Hash.

A solid walkthrough covering credential abuse, AD misconfigurations, Kerberos attacks, and pivoting techniques.

#HackTheBox #CyberSecurity #RedTeam #PenetrationTesting #ActiveDirectory #Kerberos #PrivilegeEscalation #EthicalHacking #Infosec #OffensiveSecurity …

Learn MoreHack The Box: Eighteen Machine Walkthrough – Easy Difficulity

7 Mar, 2026

Hack The Box: Expressway Machine – Easy Difficulity

Easy Machine Challenges, chwoot, CVE-2025-32463, HackTheBox, ike-scan, ISAKMP, john, Linux, psk-crack, ssh, sudo

Just completed Expressway on Hack The Box (Easy difficulty) – a solid box that blends weak IKE PSK cracking with a straightforward sudo privilege escalation!
Enumeration started with UDP scanning, which revealed ISAKMP on port 500. I ran ike-scan in Aggressive Mode to leak the peer identity ike@expressway.htb and capture crackable parameters. Next I used psk-crack against rockyou.txt and recovered the PSK freakingrockstarontheroad in under 13 seconds. I logged in via SSH as ike using that password and quickly grabbed user.txt.

For privilege escalation, sudo -l confirmed no rights for the ike user. Checking sudo -V showed version 1.9.17 vulnerable to CVE-2025-32463 (chwoot). I cloned the PoC repository on my attack machine, hosted sudo-chwoot.sh with a Python HTTP server, transferred it to the target using curl, made it executable, and ran it. The script printed “woot!” and dropped an instant root shell. From there I read root.txt.
Nice and clean chain: weak PSK for initial access followed by a known sudo vulnerability for root. Perfect easy box to sharpen IKE enumeration and Linux local exploitation skills.

#HackTheBox #CTF #PenetrationTesting #Cybersecurity #EthicalHacking #IKE #PSKCracking #PrivilegeEscalation #LinuxExploitation #CVE202532463 #RedTeam …

Learn MoreHack The Box: Expressway Machine – Easy Difficulity

14 Feb, 2026

Hack The Box: Soulmate machine walkthrough – Easy Difficulitty

Easy Machine BurpSuite, Challenges, crushftp, erlang SSH, ffuf, gobuster, HackTheBox, Linux, Penetration Testing, ssh

Just completed the Soulmate machine on Hack The Box — rated Easy, but packed with a satisfying vuln chain!
Started with subdomain enumeration → discovered an exposed CrushFTP admin panel on ftp.soulmate.htb. Exploited an unauthenticated API flaw (CVE-2025-31161 style) in the /WebInterface/function/ endpoint to enumerate users and create a backdoor admin account. From there, abused broken access controls in User Manager to reset the “ben” account password. Logged in as “ben” → gained VFS access to /webProd (the main web root), uploaded a PHP webshell → got RCE as www-data with a reverse shell.
Credential reuse let me su ben and grab user.txt

Root came via a backdoored Erlang SSH daemon on localhost:2222 (hardcoded always-true auth, running as root) → trivial escalation to root Eshell and root.txt

Key takeaways: exposed admin panels are goldmines, weak API auth leads to quick takeovers, credential reuse is still everywhere, and custom services with backdoors can hand you root on a platter.
Loved the progression from web misconfig → file write → RCE → local privesc. Solid learning box!

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #CTF #PrivilegeEscalation #RCE #BugBounty #RedTeam …

Learn MoreHack The Box: Soulmate machine walkthrough – Easy Difficulitty

Threatninja.net

Threatninja.net

Category Archives: Easy Machine