• Search for:

    Category Archives: HackTheBox

    1. Home  - Challenges
    2. Archive by category "HackTheBox"
      3. ( Page3 )
    1 Nov, 2025
    Hack The Box: Voleur Machinen Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , , ,

    Cracked a password-protected Excel on an SMB share to recover service-account credentials, used Kerberos to access a user account and capture user.txt, then leveraged AD write permissions to restore a deleted admin, decrypt DPAPI artefacts for high‑priv creds, and access the DC to grab root.txt.

    #HackTheBox #ADSecurity #Kerberos #DPAPI #RedTeam #CTF
    …

    Learn MoreHack The Box: Voleur Machinen Walkthrough – Medium Difficulty

    25 Oct, 2025
    Hack The Box: Artificial Machine Walkthrough – Easy Diffucilty
    Easy Machine , , , , , , , , , ,

    Hacking the “Artificial” Machine on Hack The Box!

    Conquered the “Artificial” machine on Hack The Box! 🕵️‍♂️ I scanned the target, identified a web server on port 80, and created an account to access its dashboard, where I uploaded a malicious .h5 file to trigger a reverse shell. Using a Docker environment, I gained a shell as the app user, found a SQLite database (users.db), and cracked its password hashes to reveal credentials for user “gael,” allowing me to grab the user flag via SSH from user.txt. For root, I discovered port 9898 running Backrest, forwarded it, and enumerated backup files, finding a bcrypt-hashed password in config.json. Decoding a base64 value yielded a plaintext password, granting access to the Backrest dashboard, where I exploited the RESTIC_PASSWORD_COMMAND to trigger a root shell and secure the root flag from root.txt.

    #Cybersecurity #HackTheBox #CTF #PenetrationTesting #PrivilegeEscalation …

    Learn MoreHack The Box: Artificial Machine Walkthrough – Easy Diffucilty

    18 Oct, 2025
    Hack The Box: DarkCorp Machine Walkthrough – Insane Difficulity
    Insane Machine , , , , , , , , , , , ,

    Finished the Insane-level DarkCorp box on Hack The Box. Initial foothold came from registering on a webmail portal and abusing a contact form to deliver a payload that resulted in a reverse shell. From there I enumerated the app and DB, identified SQL injection and extracted hashes (cracked one to thePlague61780), recovered DPAPI master key material and additional credentials (Pack_beneath_Solid9!), and used those artifacts to escalate to root and retrieve root.txt. Valuable practice in web vectors, SQLi exploitation, credential harvesting, DPAPI analysis, and Windows privilege escalation. Happy to share high-level notes or mitigations.

    #HackTheBox #Infosec #RedTeam #Pentesting #WindowsSecurity #CredentialHunting #CTF …

    Learn MoreHack The Box: DarkCorp Machine Walkthrough – Insane Difficulity

    11 Oct, 2025
    Hack The Box: Tombwatcher Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , ,

    I cracked a Kerberos TGS for Alfred (password: basketballl), used BloodHound-guided enumeration and account takeover to obtain John’s machine credentials and retrieved the user flag (type user.txt); then I abused a misconfigured certificate template (ESC15) with Certipy to request an Administrator certificate, obtained a TGT (administrator.ccache), extracted the Administrator NT hash and used it to access the DC and read the root flag (type root.txt).

    #HackTheBox #RedTeam #ActiveDirectory #Kerberos #CertAuth #BloodHound #OffensiveSecurity #Infosec #PrivilegeEscalation …

    Learn MoreHack The Box: Tombwatcher Machine Walkthrough – Medium Difficulty

    4 Oct, 2025
    Hack The Box: Certificate Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , , , , ,

    I recently completed the “Certificate” challenge on Hack The Box: after extracting and cracking a captured authentication hash I gained access to a user account (lion.sk) and retrieved the user flag, then progressed to full system compromise by responsibly exploiting weak certificate‑based authentication controls—obtaining and converting certificate material into elevated credentials to capture the root flag. The exercise reinforced how misconfigurations in certificate services and poor time synchronization can create powerful escalation paths, and highlighted the importance of least‑privilege, strict enrollment policies, and monitoring certificate issuance. Great hands‑on reminder that defensive hygiene around PKI and identity services matters.

    #CyberSecurity #HTB #Infosec #ADCS #Certificates #PrivilegeEscalation #RedTeam #Pentesting …

    Learn MoreHack The Box: Certificate Machine Walkthrough – Hard Difficulty

    27 Sep, 2025
    Hack The Box: Puppy Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , , ,

    Crushed the Puppy machine on HTB with surgical precision! Unlocked the user flag by leveraging levi.james credentials to access the DEV share, cracking recovery.kdbx with “Liverpool,” and using ant.edwards:Antman2025! to reset ADAM.SILVER’s password, followed by a swift WinRM login to grab user.txt. For the root flag, extracted steph.cooper:ChefSteph2025! from C:\Backups, accessed a WinRM shell, and exfiltrated DPAPI keys via SMB. Impacket unveiled steph.cooper_adm:FivethChipOnItsWay2025!, opening the Administrator directory to claim root.txt.

    #Cybersecurity #HackTheBox #CTF #Pentesting #PrivilegeEscalation …

    Learn MoreHack The Box: Puppy Machine Walkthrough – Medium Difficulty

    20 Sep, 2025
    Hack The Box: Fluffy Machine Walkthrough – Easy Difficulity
    Easy Machine , , , , , , , , , , , ,

    Introduction to Fluffy: In this write-up, we will explore the “Fluffy” machine from Hack The Box, categorised as an easy difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Machine InformationIn

    Continue ReadingHack The Box: Fluffy Machine Walkthrough – Easy Difficulity

    13 Sep, 2025
    Hack The Box: Planning Machine Walkthrouh – Easy Diffucilty
    Easy Machine , , , , , , , , , , , , ,

    Introduction to Planning: In this write-up, we will explore the “Planning” machine from Hack The Box, categorised as an easy difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective: The

    Continue ReadingHack The Box: Planning Machine Walkthrouh – Easy Diffucilty

    6 Sep, 2025
    Hack The Box: Environment Machine Walkthough-Medium Difficulty
    Medium Machine , , , , , , , , , , , , ,

    Environment HTB: Full User & Root Flag Capture Through Exploitation

    Captured both the user and root flags on the Environment HTB machine! We exploited Laravel 11.30.0 (PHP 8.2.28) vulnerabilities, including argument injection (CVE-2024-52301) and UniSharp Laravel Filemanager code injection. By bypassing authentication with `–env=preprod` and leveraging the profile upload feature, we executed a PHP reverse shell and retrieved the user flag via `cat user.txt`. For root access, we decrypted `keyvault.gpg` from the `.gnupg` directory to obtain credentials and exploited sudo with preserved BASH\_ENV by crafting a script that spawned a privileged shell, ultimately gaining full control of the system.

    #CyberSecurity #HTB #PenTesting #EthicalHacking #LaravelExploits #PrivilegeEscalation #PHP #Infosec #BugBounty #RedTeam
    …

    Learn MoreHack The Box: Environment Machine Walkthough-Medium Difficulty

    30 Aug, 2025
    Hack The Box: Eureka Machine Walkthrough – Hard Dificulty
    Hard Machine , , , , , , , , , , ,

    I enumerated Spring Boot Actuator endpoints, including /actuator/heapdump, which revealed plaintext credentials for oscar190. SSH login as oscar190 was successful, though the home directory was empty. Analysis of application.properties exposed Eureka credentials (EurekaSrvr:0scarPWDisTheB3st), granting access to the Eureka dashboard. By registering a malicious microservice, I retrieved miranda.wise credentials and captured the user flag. For privilege escalation, I identified a vulnerable log_analyse.sh script, performed command injection, and created a SUID bash shell in /tmp/bash. Executing this shell provided root access, allowing retrieval of the root flag and full control of the machine.

    #CyberSecurity #EthicalHacking #HackTheBox #PenTesting #PrivilegeEscalation #WebSecurity #SpringBoot #CTF #BugHunting #InfoSec #RedTeam #OffensiveSecurity …

    Learn MoreHack The Box: Eureka Machine Walkthrough – Hard Dificulty