Tag API

Medium Machine

Hack The Box: DevArea Machine Walkthrough – Medium Difficulty

Just completed the DevArea machine from Hack The Box!

After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking

darknite
2026-07-04

Medium Machine

Hack The Box:Interpreter Machine Walkthrough – Medium Difficulty

Completed Hack The Box machine “Interpreter” after exploiting CVE-2023-43208 in NextGen Healthcare Mirth Connect 4.4.0. Initial access involved API enumeration, unsafe Java deserialization exploitation, reverse shell execution, and database credential extraction from Mirth Connect configuration files. Cracking the recovered PBKDF2-HMAC-SHA256 hash provided SSH access as sedric and access to the user flag.

Privilege escalation involved enumerating a root-owned Flask notification service vulnerable to Server-Side Template Injection (SSTI). By forwarding the internal service over SSH and crafting a malicious XML payload, remote command execution as root was achieved, leading to retrieval of the root flag.

#HackTheBox #HTB #CyberSecurity #RedTeam #EthicalHacking #PenetrationTesting #OffensiveSecurity #WebSecurity #PrivilegeEscalation #SSTI #Deserialization #Linux #InfoSec #CVE202343208

darknite
2026-05-30

Medium Machine

Hack The Box: Instant Machine Walkthrough – Medium Difficulty

Introduction to Instant: In this writeup, we will explore the “Instant” machine from Hack The Box, which is categorized as a medium-difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective:…

darknite
2025-03-01

Medium Machine

Hack The Box: Interface Machine Walkthrough – Medium Difficulty

In this post, I would like to share a walkthrough of the Interface Machine from Hack the Box This room will be considered a medium machine on Hack the Box What will you gain from the Interface machine? For the user…

darknite
2023-05-13

Medium Machine

Hack The Box: Encoding Machine – Medium Difficulty

In this post, I would like to share a walkthrough of the Encoding Machine from Hack the Box This room will be considered a medium machine on Hack the Box What will you gain from the Encoding machine? For the user…

darknite
2023-04-15

Medium Machine

Hack The Box: Mentor Machine Walkthrough – Medium Difficulty

In this post, I would like to share a walkthrough of the Mentor Machine from Hack the Box This room will be considered a medium machine on Hack the Box What will you gain from the Mentor machine? For the user…

darknite
2023-03-11

Medium Machine

Hack The Box: Awkward Machine Walkthrough – Medium Difficulty

In this post, I would like to share a walkthrough of the Awkward Machine from Hack the Box This room will be considered a medium machine on Hack the Box What will you gain from the Awkward machine? For the user…

darknite
2023-02-26

Hard Machine

Hack The Box: Rainyday Machine Walkthrough – Hard Difficulty

In this post, I would like to share a walkthrough of the Rainyday Machine from Hack the Box This room will be considered a Hard machine on Hack the Box What will you gain from the RainyDay machine? For the user…

darknite
2023-02-19

Insane Machine

Hack The Box: Response Machine Walkthrough – Insane Difficulty

In this post, I would like to share a walkthrough of the Response Machine from Hack the Box This room will be considered an Insane machine on Hack the Box What will you gain from the Response machine? For the user…

darknite
2023-02-06

Penetration Testing

Learning Series: API Penetration Testing

What is API Penetration Testing? For those who are not familiar with API Penetration Testing, it’s a test activity that involves all the processes of vulnerability assessment and ensures that the client is implementing very solid endpoints for their APIs…

darknite
2022-12-26