Tag BurpSuite

Hack The Box: Wingdata Machine Walkthrough – Easy Difficulty

I recently completed the Wingdata machine on Hack The Box! This easy-rated challenge involved exploiting an unauthenticated command injection vulnerability (CVE-2025-47812) in the Wing FTP Server web client to gain initial access as the wingftp user. After enumerating the system and cracking a SHA-256 password hash from a user configuration file using Hashcat, I escalated to the wacky user.

Finally, I leveraged a vulnerable Python backup restoration script by injecting a malicious tarball containing my SSH public key, achieving full root access. A great box for practicing web application exploitation, password cracking, and creative privilege escalation techniques.

#HackTheBox #PenetrationTesting #CyberSecurity #EthicalHacking #PrivilegeEscalation

Hack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

We completed the “Nanocorp” Active Directory lab on Hack The Box, covering full chain exploitation from initial access to domain compromise.

User access was achieved by exploiting a ZIP extraction flaw in a recruitment portal, leading to NTLM hash capture via a malicious .library-ms file and credential recovery for web_svc. Active Directory misconfigurations allowed privilege escalation to monitoring_svc through BloodHound-guided abuse of ForceChangePassword rights.

Root access was obtained after enumerating CheckMK Agent 2.1 on the Domain Controller. A web shell enabled command execution as web_svc, followed by exploitation of the CheckMK MSI repair process (CVE-2024-0670) using RunasCs to achieve SYSTEM-level access.

#HackTheBox #ActiveDirectory #Pentesting #RedTeam #PrivilegeEscalation #CyberSecurity #WindowsDomain #BloodHound

Hack The Box – VariaType Machine Walkthrough Medium Difficulty

Recently completed a Medium-difficulty machine that combined web exploitation, file-processing abuse, and privilege escalation techniques.

The path to user access involved leveraging a vulnerable backend font-processing workflow and a ZIP-based exploitation chain to obtain a reverse shell and pivot to a legitimate user account. From there, further enumeration uncovered a misconfigured sudo rule that allowed privilege escalation to root through a Python-based validation script.

This machine provided valuable practice in identifying attack paths, chaining vulnerabilities, and understanding how seemingly minor misconfigurations can lead to full system compromise.

Key takeaways:
✅ Thorough enumeration is critical
✅ File-processing functionality can introduce unexpected attack surfaces
✅ Misconfigured sudo permissions remain a common privilege-escalation vector

#CyberSecurity #EthicalHacking #PenetrationTesting #PrivilegeEscalation #RedTeam #LinuxSecurity #CTF #HackTheBox #InfoSec #SecurityResearch

Hack The Box: Facts Machine Walkthrough – Easy Difficulty

Completed the Facts machine from Hack The Box, an easy-rated Linux challenge that combined web exploitation, cloud storage enumeration, SSH key recovery, and privilege escalation.

The initial foothold came from exploiting CVE-2025-2304, a mass assignment vulnerability in Camaleon CMS 2.9.0, which allowed privilege escalation from a low-privileged user to administrator. Access to the administration panel exposed S3 configuration details and credentials, leading to enumeration of an internal bucket containing an encrypted SSH private key. After recovering the key's passphrase with John the Ripper, SSH access as the trivia user was obtained.

Privilege escalation to root involved abusing facter, a Ruby-based utility executable via sudo without a password. By leveraging its --custom-dir option to load a malicious custom fact, arbitrary commands were executed as root, resulting in full system compromise.

A great machine that highlights the impact of insecure parameter handling, cloud storage exposure, and the risks associated with misconfigured sudo privileges.

#HackTheBox #HTB #Facts #CyberSecurity #PenetrationTesting #EthicalHacking #RedTeam #PrivilegeEscalation #Linux #AWS #S3 #CamaleonCMS #CVE20252304 #JohnTheRipper #Ruby #Infosec #CTF #CyberSecurityLearning

Hack The Box:Interpreter Machine Walkthrough – Medium Difficulty

Completed Hack The Box machine “Interpreter” after exploiting CVE-2023-43208 in NextGen Healthcare Mirth Connect 4.4.0. Initial access involved API enumeration, unsafe Java deserialization exploitation, reverse shell execution, and database credential extraction from Mirth Connect configuration files. Cracking the recovered PBKDF2-HMAC-SHA256 hash provided SSH access as sedric and access to the user flag.

Privilege escalation involved enumerating a root-owned Flask notification service vulnerable to Server-Side Template Injection (SSTI). By forwarding the internal service over SSH and crafting a malicious XML payload, remote command execution as root was achieved, leading to retrieval of the root flag.

#HackTheBox #HTB #CyberSecurity #RedTeam #EthicalHacking #PenetrationTesting #OffensiveSecurity #WebSecurity #PrivilegeEscalation #SSTI #Deserialization #Linux #InfoSec #CVE202343208

Hack The Box: MonitorsFour Machine Walkthrough – Easy Diffucilty

Wrapped up another solid box with a clean chain from web exploitation to full host compromise.

Gained initial access through an IDOR vulnerability on the /user endpoint, which exposed an admin hash that cracked to wonderful1. This provided access to the Cacti dashboard as marcus. From there, exploiting CVE-2025-24367 led to a reverse shell inside a Docker container as www-data, where the user flag was retrieved.

Privilege escalation came from spotting an exposed Docker API. By deploying a privileged container and mounting the host filesystem, it was possible to break out of the container and access the Windows host, ultimately retrieving the root flag.

Nice reminder of how small web flaws can cascade into full infrastructure compromise when combined with misconfigurations like exposed Docker daemons.

#cybersecurity #penetrationtesting #redteam #docker #privilegeescalation #websecurity #ethicalhacking #infosec

Hack The Box: Pterodactyl Machine Walkthrough – Medium Difficulity

Completed the Pterodactyl machine on Hack The Box, focusing on end-to-end exploitation.

The attack started with a path traversal vulnerability (CVE-2025-49132) in the Pterodactyl Panel, leading to unauthenticated RCE. This access allowed database extraction, credential recovery, and SSH access as a low-privileged user.

Privilege escalation was achieved through PAM environment variable poisoning (CVE-2025-6018), followed by a more stable root shell using a libblockdev/udisks race condition (CVE-2025-6019).

A solid exercise in chaining web exploitation with local privilege escalation techniques.

#HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #CTF #Linux #PrivilegeEscalation #WebSecurity

Hack The Box: Sorcery Machine Walkthrough – Insane Difficulty

Recently, I completed the “Sorcery” machine on Hack The Box (Insane difficulty), which provided a deep, multi-layered challenge combining modern web exploitation, internal pivoting, and complex privilege escalation.

The attack began with reconnaissance of a self-hosted Gitea instance, where exposed source code revealed the application architecture. This led to identifying a Cypher injection vulnerability in functionality backed by Neo4j, which enabled SSRF to leak sensitive data such as password hashes and a registration key. After gaining seller access, a stored XSS payload was used to hijack an admin session and access a restricted debug feature. This interface allowed interaction with internal services, ultimately achieving remote code execution via a Kafka-based payload. From there, pivoting with Ligolo-ng exposed internal services, including an FTP server containing an encrypted private key, which was cracked offline to gain SSH access and retrieve the user flag.

Privilege escalation required chaining multiple subtle misconfigurations. A running Xvfb instance exposed a screen dump containing credentials for a higher-privileged user. With limited sudo access, strace was used to capture plaintext credentials from running processes. Further enumeration revealed activity tied to FreeIPA, where identity management controls were abused to gain full sudo privileges. After applying the changes, this ultimately led to root access and full system compromise.

#HackTheBox #CyberSecurity #PenetrationTesting #RedTeam #EthicalHacking #CTF #Infosec #PrivilegeEscalation #WebSecurity

Hack The Box: Airtouch Mahcine Walkthrough – Medium Diffiiculty

Recently, I completed the “Airtouch” machine on Hack The Box (Medium difficulty), which provided a great hands-on experience in combining system exploitation with wireless attack techniques.

The challenge started with basic reconnaissance and service enumeration, leading to initial access via SSH as a low-privileged user. From there, misconfigured sudo permissions allowed quick privilege escalation on the host. What made this machine particularly interesting was its setup as a wireless attack platform, requiring interaction with a simulated corporate Wi-Fi environment.

By cracking a WPA2-PSK handshake and connecting to the internal network, I was able to pivot further, access an internal access point, and exploit an unrestricted file upload vulnerability to gain remote shell access. Additional enumeration revealed credentials that enabled lateral movement to a management server, ultimately leading to full root compromise.

Overall, this machine was a great reminder of how misconfigurations, weak credentials, and insecure file handling can chain together into a full system compromise—especially in complex environments involving internal networks and wireless infrastructure.

#HackTheBox #CyberSecurity #PenetrationTesting #RedTeam #EthicalHacking #CTF #Infosec #PrivilegeEscalation #NetworkSecurity

Hack The Box: Gavel Machine Walkthrough – Medium Difficulity

Completed the Gavel (Medium) machine on Hack The Box. The initial foothold came from an exposed .git directory that leaked the application’s source code and bcrypt password hashes. After cracking the credentials with John the Ripper, I gained access and achieved a reverse shell through command injection in the admin rule field. Reusing the cracked credentials allowed privilege escalation to the application user and retrieval of the user flag.

Root access was obtained by abusing the gavel-util submission feature, which executed YAML rule fields using PHP system(). By overwriting the custom php.ini to remove restrictions and creating a SUID Bash binary, it was possible to spawn a root shell and capture the final flag.

#HackTheBox #HTB #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #LinuxSecurity #WebSecurity #PrivilegeEscalation #CTF