I enumerated Spring Boot Actuator endpoints, including /actuator/heapdump, which revealed plaintext credentials for oscar190. SSH login as oscar190 was successful, though the home directory was empty. Analysis of application.properties exposed Eureka credentials (EurekaSrvr:0scarPWDisTheB3st), granting access to the Eureka dashboard. By registering a malicious microservice, I retrieved miranda.wise credentials and captured the user flag. For privilege escalation, I identified a vulnerable log_analyse.sh script, performed command injection, and created a SUID bash shell in /tmp/bash. Executing this shell provided root access, allowing retrieval of the root flag and full control of the machine.

#CyberSecurity #EthicalHacking #HackTheBox #PenTesting #PrivilegeEscalation #WebSecurity #SpringBoot #CTF #BugHunting #InfoSec #RedTeam #OffensiveSecurity …

Learn MoreHack The Box: Eureka Machine Walkthrough – Hard Dificulty

I successfully captured both user and root flags by exploiting a file upload vulnerability to gain a web shell, extracting database credentials from config.php, and cracking the user hash to reveal the password Jenni_Luvs_Magic23. Using these credentials, I accessed the web application, discovered an SSH migration hint, and leveraged a Kerberos ticket (f.frizzle.ccache) to gain SSH access and retrieve the user flag with type user.txt. For the root flag, I escalated privileges using M.SchoolBus and SharpGPOAbuse to manipulate SleepGPO, applied changes with gpupdate.exe /force, extracted credentials with secretdump, and used wmiexec to secure a root-level shell, ultimately reading the root flag with type root.txt.

#Cybersecurity #CTF #EthicalHacking #PenetrationTesting …

Learn MoreHack The Box: TheFrizz Machine Walkthrough – Medium Difficulity

Captured the user flag by exploiting a file upload feature, unpacking .odt files to reveal a hidden password with xmllint, and injecting a reverse shell via the backup feature to get a www-data shell. Retrieved hashes from the nocturnal_database, cracked Tobias’s password (slowmotionapocalypse), and obtained the user flag. For the root flag, enumerated open ports, found port 8080 running ISPConfig, accessed it with admin credentials, identified the version, executed a public exploit, and gained root shell to capture the root flag.

#HTB #HackTheBox #CyberSecurity #RedTeam #CTF #PenTesting #Nocturnal #LinuxExploitation #WebExploitation #PrivilegeEscalation …

Learn MoreHack The Box: Nocturnal Machine Walkthrough – Easy Difficulty

Compromised university.htb by exploiting ReportLab RCE (CVE-2023-33733) to gain initial access as wao. Forged a professor certificate to impersonate george, then uploaded a malicious lecture to compromise Martin.T.

Escalated privileges by exploiting a scheduled task with a malicious .url file, used LocalPotato (CVE-2023-21746) for elevation on WS-3, and abused SeBackupPrivilege to extract NTDS.dit, ultimately retrieving Domain Admin credentials.

🔍 A great hands-on challenge combining web exploitation, privilege escalation, and Active Directory abuse.

#CyberSecurity #RedTeam #CTF #PrivilegeEscalation #HTB #InfoSec #WindowsExploitation #PenetrationTesting #EthicalHacking #HackTheBox …

Learn MoreHack The Box: University Machine Walkthrough – Insane Walkthrough

Successfully exploited a code execution vulnerability in a web application by bypassing keyword restrictions through Python class enumeration, leading to a reverse shell as the app-production user and retrieval of the user.txt flag. Leveraged access to a SQLite database to crack credentials for the martin user and escalate privileges. Identified a backup script running with root privileges, crafted a malicious JSON payload to include the root directory in backups, and ultimately obtained the root.txt flag.

This engagement highlights the importance of secure input validation, credential management, and careful privilege delegation in application security.

#Cybersecurity #HackTheBox #CTF #PenetrationTesting #PrivilegeEscalation #ApplicationSecurity …

Learn MoreHack The Box: Code Machine Walkthrough – Easy Difficulity

Successfully exploited a vulnerable Neo4j database via Cypher injection to extract credentials, gain SSH access, and retrieve the user flag. Then leveraged a misconfigured `bbot` binary with sudo rights to set the SUID bit on `/bin/bash`, escalating privileges to root and capturing the root flag. #Cybersecurity #Neo4j #CypherInjection #PrivilegeEscalation #Pentesting #EthicalHacking #InfoSec …

Learn MoreHack The Box: Cypher Machine Walkthrough – Medium Difficultyy

I conquered the “Scepter” machine on Hack The Box, a challenging Active Directory exploit! Initially, I cracked weak .pfx certificate passwords using pfx2john and rockyou.txt. After syncing time, I extracted D.BAKER’s NTLM hash via Certipy and used BloodHound to reveal A.CARTER’s password reset privileges, exploiting ESC9 to capture the user flag. Subsequently, H.BROWN’s access to P.ADAMS’s altSecurityIdentities enabled an ESC14 attack, forging a certificate for passwordless authentication. Consequently, P.ADAMS’s DCSync rights allowed domain hash extraction, securing the root flag via Evil-WinRM.

#Cybersecurity #HackTheBox #ActiveDirectory #PrivilegeEscalation #CTF #EthicalHacking …

Learn MoreHack The Box: Scepter Machine Walkthrough – Hard Difficulty

Exploited exposed credentials in a .git repository to access Backdrop CMS, then used a remote command execution vulnerability (EDB-ID: 52021) for a reverse shell. Escalated to root by leveraging a misconfigured bee binary with sudo privileges, capturing both user and root flags.

#Cybersecurity #HackTheBox #PenetrationTesting #CTF #WebExploitation #PrivilegeEscalation #EthicalHacking #InfoSec #CyberSec #Hacking …

Learn MoreHack The Box: Dog Machine Walkthrough (Easy Difficulty)

Hack The Box Success: Cat Machine Write-Up Published!

I’ve just published my personal write-up for the Cat machine on Hack The Box. In this challenge, I gained the user flag by exploiting a Stored XSS vulnerability to capture the admin session cookie, followed by an SQL Injection to extract credentials and gain SSH access. For the root flag, I took advantage of a vulnerable image processing script owned by root, crafting a payload to gain a root shell and retrieve the flag. The full write-up dives into each step, the logic behind the attacks, and key takeaways.

#CyberSecurity #HackTheBox #PenetrationTesting #EthicalHacking #CTF #WriteUp #XSS #SQLi #PrivilegeEscalation #InfoSec #CTFWriteup …

Learn MoreHack The Box: Cat Machine Walkthrough – Medium Diffculity

CVE-2025-32463 – Local Privilege Escalation via Sudo’s chroot Option
I recently explored a vulnerability in Sudo that allows unprivileged users to escalate to root by abusing the rarely used -R (chroot) feature and manipulating nsswitch.conf. Tested on Parrot OS, this PoC demonstrates how easy it is to gain root shell access when Sudo < 1.9.17p1 is installed. If you're running Linux, patch immediately or compile Sudo from source to version 1.9.17p1 or later. Stay safe, patch early. #CyberSecurity #Linux #CVE2025 #PrivilegeEscalation #InfoSec #ExploitDevelopment #Sudo #BlueTeam #RedTeam #ParrotOS #ThreatHunting #VulnerabilityResearch …

Learn MoreAbusing Sudo’s chroot: CVE-2025-32463 Explained