Tag Gitea

Hack The Box: Fries Machine Walkthrough – Hard Difficulty

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF

Hack The Box: Sorcery Machine Walkthrough – Insane Difficulty

Recently, I completed the “Sorcery” machine on Hack The Box (Insane difficulty), which provided a deep, multi-layered challenge combining modern web exploitation, internal pivoting, and complex privilege escalation.

The attack began with reconnaissance of a self-hosted Gitea instance, where exposed source code revealed the application architecture. This led to identifying a Cypher injection vulnerability in functionality backed by Neo4j, which enabled SSRF to leak sensitive data such as password hashes and a registration key. After gaining seller access, a stored XSS payload was used to hijack an admin session and access a restricted debug feature. This interface allowed interaction with internal services, ultimately achieving remote code execution via a Kafka-based payload. From there, pivoting with Ligolo-ng exposed internal services, including an FTP server containing an encrypted private key, which was cracked offline to gain SSH access and retrieve the user flag.

Privilege escalation required chaining multiple subtle misconfigurations. A running Xvfb instance exposed a screen dump containing credentials for a higher-privileged user. With limited sudo access, strace was used to capture plaintext credentials from running processes. Further enumeration revealed activity tied to FreeIPA, where identity management controls were abused to gain full sudo privileges. After applying the changes, this ultimately led to root access and full system compromise.

#HackTheBox #CyberSecurity #PenetrationTesting #RedTeam #EthicalHacking #CTF #Infosec #PrivilegeEscalation #WebSecurity

Hack The Box: Browsed Machine Walkthrough – Medium Diffucility

Completed the Browsed machine on Hack The Box 🚀

Gained initial access by uploading a malicious Chrome extension with a reverse shell payload. Automated testing executed it, giving a foothold as larry and access to user flag.

Escalated privileges by abusing a misconfigured sudo rule on extension_tool.py. A world-writable pycache directory allowed bytecode poisoning, leading to root access and full compromise.

Great box for practicing client-side attacks, extension abuse, and privilege escalation via Python internals.

#HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #PrivilegeEscalation #WebSecurity #CTF

Hack The Box: Cat Machine Walkthrough – Medium Diffculity

Hack The Box Success: Cat Machine Write-Up Published!

I’ve just published my personal write-up for the Cat machine on Hack The Box. In this challenge, I gained the user flag by exploiting a Stored XSS vulnerability to capture the admin session cookie, followed by an SQL Injection to extract credentials and gain SSH access. For the root flag, I took advantage of a vulnerable image processing script owned by root, crafting a payload to gain a root shell and retrieve the flag. The full write-up dives into each step, the logic behind the attacks, and key takeaways.

#CyberSecurity #HackTheBox #PenetrationTesting #EthicalHacking #CTF #WriteUp #XSS #SQLi #PrivilegeEscalation #InfoSec #CTFWriteup

Hack The Box: Ghost Machine Walkthrough – Insane Difficulty

The initial foothold was gained by exploiting command injection on intranet.ghost.htb:8008/api-dev/scan/, which provided a reverse shell inside a Docker container. From there, I enumerated the environment and discovered credentials that allowed SSH access as Florence Ramirez. By extracting and converting a Kerberos ticket, I authenticated as a legitimate user, escalating access within the system. With access to the Windows environment, I retrieved NTLM hashes for the adfs_gmsa account and leveraged evil-winrm for lateral movement. A reverse shell was established using JokerShell, and privileges were escalated by enabling xp_cmdshell through a debug interface. After uploading EfsPotato.cs and disabling antivirus, I used Mimikatz and Rubeus.exe to dump credentials, ultimately achieving SYSTEM access. This led to the extraction of domain admin credentials and the retrieval of the root flag. Another Insane box down! 💀💻

#HackTheBox #RedTeam #CyberSecurity #PenTesting #PrivilegeEscalation #EthicalHacking