hashcat Archives - Threatninja.net

3 Oct, 2026

Hack The Box: Reactor Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2025-55182, devtools, HackTheBox, hashcat, Linux, next.js, node, Penetration Testing, port forwarding, react, React2shell, sqlite3, ssh

Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.

The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.

From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.

For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.

I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.

Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …

Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty

19 Sep, 2026

Hack The Box: Hercules Machine Walkthrough – Insane Diffucility

Insane Machine Bloodhound, bloodyAD, BurpSuite, Certipy, Challenges, changepassword.py, describeticket.py, dotnet, getTGT, HackTheBox, hashcat, impacket-getST, kerbrute, LDAP, odt, Penetration Testing, PowerView, python3, responder, SSO Authentication, Windows, winrmexec

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge.

This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse.

The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin.

From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account.

The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain.

The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop.

Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets.

Documented as part of my continued HTB practice and learning in Active Directory and offensive security.

#HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning …

Learn MoreHack The Box: Hercules Machine Walkthrough – Insane Diffucility

15 Aug, 2026

HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

Insane Machine BurpSuite, Challenges, Cobbler’s XML-RPC, CVE-2024-47533, gobuster, HackTheBox, hashcat, Linux, MySQL, mysql database, Penetration Testing, port forwarding, python3, SQL Injection, ssh, ssrf, Stored XSS, Twig SSTI

Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.

Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.

Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.

#HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 …

Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

25 Jul, 2026

Hack The Box: Fries Machine Walkthrough – Hard Difficulty

Hard Machine Bloodhound, Certipy, Challenges, DebugFS, docker, Gitea, gobuster, HackTheBox, hashcat, LDAP injection, Ligolo-ng, Linux, metasploit, nfs, Penetration Testing, pgAdmin4, port forwarding, PostgreSQL, rustscan, Samba, ssh, Windows

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF …

Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty

11 Jul, 2026

Hack The Box: CCTV machine walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2024-5148, CVE-2025-60787, HackTheBox, hashcat, Linux, MotionEye, port forwarding, sqlmap, ssh, Zoneminder

Just completed the CCTV machine from Hack The Box!

After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

27 Jun, 2026

Hack The Box: Wingdata Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2025-4517, CVE-2025-47812, HackTheBox, hashcat, Linux, Penetration Testing, python3, ssh

I recently completed the Wingdata machine on Hack The Box! This easy-rated challenge involved exploiting an unauthenticated command injection vulnerability (CVE-2025-47812) in the Wing FTP Server web client to gain initial access as the wingftp user. After enumerating the system and cracking a SHA-256 password hash from a user configuration file using Hashcat, I escalated to the wacky user.

Finally, I leveraged a vulnerable Python backup restoration script by injecting a malicious tarball containing my SSH public key, achieving full root access. A great box for practicing web application exploitation, password cracking, and creative privilege escalation techniques.

#HackTheBox #PenetrationTesting #CyberSecurity #EthicalHacking #PrivilegeEscalation …

Learn MoreHack The Box: Wingdata Machine Walkthrough – Easy Difficulty

20 Jun, 2026

Hack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

Hard Machine Bloodhound, bloodyAD, BurpSuite, Challenges, CheckMK Agent, CVE-2024-0670, evil-winrm, gobuster, HackTheBox, hashcat, responsder, Windows

We completed the “Nanocorp” Active Directory lab on Hack The Box, covering full chain exploitation from initial access to domain compromise.

User access was achieved by exploiting a ZIP extraction flaw in a recruitment portal, leading to NTLM hash capture via a malicious .library-ms file and credential recovery for web_svc. Active Directory misconfigurations allowed privilege escalation to monitoring_svc through BloodHound-guided abuse of ForceChangePassword rights.

Root access was obtained after enumerating CheckMK Agent 2.1 on the Domain Controller. A web shell enabled command execution as web_svc, followed by exploitation of the CheckMK MSI repair process (CVE-2024-0670) using RunasCs to achieve SYSTEM-level access.

#HackTheBox #ActiveDirectory #Pentesting #RedTeam #PrivilegeEscalation #CyberSecurity #WindowsDomain #BloodHound …

Learn MoreHack The Box: Nanocorp Machine Walkhtrough – Hard Difficulity

30 May, 2026

Hack The Box:Interpreter Machine Walkthrough – Medium Difficulty

Medium Machine API, BurpSuite, Challenges, CVE-2023-43208, HackTheBox, hashcat, Linux, Mirth Connect Administrator, MySQL, notification service, Penetration Testing, port-forwading

Completed Hack The Box machine “Interpreter” after exploiting CVE-2023-43208 in NextGen Healthcare Mirth Connect 4.4.0. Initial access involved API enumeration, unsafe Java deserialization exploitation, reverse shell execution, and database credential extraction from Mirth Connect configuration files. Cracking the recovered PBKDF2-HMAC-SHA256 hash provided SSH access as sedric and access to the user flag.

Privilege escalation involved enumerating a root-owned Flask notification service vulnerable to Server-Side Template Injection (SSTI). By forwarding the internal service over SSH and crafting a malicious XML payload, remote command execution as root was achieved, leading to retrieval of the root flag.

#HackTheBox #HTB #CyberSecurity #RedTeam #EthicalHacking #PenetrationTesting #OffensiveSecurity #WebSecurity #PrivilegeEscalation #SSTI #Deserialization #Linux #InfoSec #CVE202343208 …

Learn MoreHack The Box:Interpreter Machine Walkthrough – Medium Difficulty

16 May, 2026

Hack The Box: Pterodactyl Machine Walkthrough – Medium Difficulity

Medium Machine BurpSuite, Challenges, CVE-2025-49132, CVE-2025-6018, CVE-2025-6019, gobuster, HackTheBox, hashcat, Linux, mariadb, Penetration Testing, python3, ssh

Completed the Pterodactyl machine on Hack The Box, focusing on end-to-end exploitation.

The attack started with a path traversal vulnerability (CVE-2025-49132) in the Pterodactyl Panel, leading to unauthenticated RCE. This access allowed database extraction, credential recovery, and SSH access as a low-privileged user.

Privilege escalation was achieved through PAM environment variable poisoning (CVE-2025-6018), followed by a more stable root shell using a libblockdev/udisks race condition (CVE-2025-6019).

A solid exercise in chaining web exploitation with local privilege escalation techniques.

#HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #CTF #Linux #PrivilegeEscalation #WebSecurity …

Learn MoreHack The Box: Pterodactyl Machine Walkthrough – Medium Difficulity

25 Apr, 2026

Hack The Box: Sorcery Machine Walkthrough – Insane Difficulty

Insane Machine BurpSuite, Challenges, Cypher Injection, docker, Gitea, HackTheBox, hashcat, ipa, Ligolo-ng, Linux, pem2john, Penetration Testing, pspy64, ssh, WebAuthn

Recently, I completed the “Sorcery” machine on Hack The Box (Insane difficulty), which provided a deep, multi-layered challenge combining modern web exploitation, internal pivoting, and complex privilege escalation.

The attack began with reconnaissance of a self-hosted Gitea instance, where exposed source code revealed the application architecture. This led to identifying a Cypher injection vulnerability in functionality backed by Neo4j, which enabled SSRF to leak sensitive data such as password hashes and a registration key. After gaining seller access, a stored XSS payload was used to hijack an admin session and access a restricted debug feature. This interface allowed interaction with internal services, ultimately achieving remote code execution via a Kafka-based payload. From there, pivoting with Ligolo-ng exposed internal services, including an FTP server containing an encrypted private key, which was cracked offline to gain SSH access and retrieve the user flag.

Privilege escalation required chaining multiple subtle misconfigurations. A running Xvfb instance exposed a screen dump containing credentials for a higher-privileged user. With limited sudo access, strace was used to capture plaintext credentials from running processes. Further enumeration revealed activity tied to FreeIPA, where identity management controls were abused to gain full sudo privileges. After applying the changes, this ultimately led to root access and full system compromise.

#HackTheBox #CyberSecurity #PenetrationTesting #RedTeam #EthicalHacking #CTF #Infosec #PrivilegeEscalation #WebSecurity …

Learn MoreHack The Box: Sorcery Machine Walkthrough – Insane Difficulty

Threatninja.net

Threatninja.net

Tag Archives: hashcat