john the ripper Archives - Threatninja.net

21 Mar, 2026

Hack The Box: Conversor Machine Walkhtrough – Easy Difficulity

Medium Machine Challenges, HackTheBox, john the ripper, Linux, needrestart, Penetration Testing, python3, source code review, sqlite3, xml, xslt

Successfully completed the Conversor machine on Hack The Box, focusing on web exploitation and privilege escalation techniques.

For the user flag, initial access was gained by exploiting an insecure XSLT file upload feature. By leveraging EXSLT, I was able to write and execute a malicious script on the server, resulting in a reverse shell as a low-privileged user. Further enumeration uncovered a SQLite database containing hashed credentials, which were cracked to obtain valid SSH access and retrieve the user flag.

For the root flag, privilege escalation was achieved through a misconfigured sudo permission allowing execution of needrestart. This was abused to run a crafted script that modified system binaries, ultimately granting root-level access via a SUID bash shell and completing the machine.

#HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #WebSecurity #PrivilegeEscalation #RedTeam #InfoSec #CaptureTheFlag #CTF …

Learn MoreHack The Box: Conversor Machine Walkhtrough – Easy Difficulity

22 Nov, 2025

Hack The Box: Mirage Machine Walkthrough – Hard Difficulity

Hard Machine autologon, BloodHoundCE, bloodyAD, Certipy, Challenges, HackTheBox, hashcat, impacket, john the ripper, nats, nfs, nxc, Penetration Testing, Windows, winpeas

Compromising the Mirage domain started with a simple clue hidden in an exposed NFS share. Inside a PDF report was a missing DNS record—just enough to pivot. By hijacking the DNS entry, I intercepted NATS JetStream traffic and captured real authentication logs, including valid credentials. After fixing the system time and obtaining a Kerberos TGT, I gained my first foothold on the domain controller and captured the user flag.

From there, the path to domain dominance unfolded through Active Directory weaknesses. An SPN ticket leak led to a cracked password, which opened the door to BloodHound reconnaissance and more credentials. I reset a disabled user’s password, extracted a service account’s managed password, and used Certipy to transform certificate abuse into full machine-level impersonation. With Resource-Based Constrained Delegation enabled, I forged Kerberos tickets, dumped every domain hash, and finally authenticated as Administrator—securing the root flag.

#CyberSecurity #PenetrationTesting #Kerberos #ActiveDirectory #RedTeam #HackTheBox #Infosec #PrivilegeEscalation …

Learn MoreHack The Box: Mirage Machine Walkthrough – Hard Difficulity

1 Nov, 2025

Hack The Box: Voleur Machinen Walkthrough – Medium Difficulty

Medium Machine Active Directory, BloodHoundCE, bloodyAD, Challenges, DPAPI, HackTheBox, hashcat, impacket, john the ripper, office2john, Penetration Testing, smbclient, Windows

14 Jun, 2025

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Insane Machine bitlocker, Bloodhound, BloodHoundCE, bloodyAD, BurpSuite, Certipy, Challenges, evil-winrm, HackTheBox, hashcat, impacket, john the ripper, kerbrute, Output Messenger, Penetration Testing, RDP, sqlite3, Windows, Wireshark

Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
Successfully completed a two-stage Active Directory exploitation scenario involving both user access and privilege escalation. The first stage focused on identifying accounts that did not require Kerberos pre-authentication (AS-REP Roasting), allowing extraction and cracking of a user password hash to gain remote access and retrieve the user flag. In the second stage, a misconfigured certificate template (ESC4 vulnerability) within Active Directory Certificate Services was exploited to request a certificate impersonating a privileged user. This enabled full administrative access and retrieval of the root flag.

#CyberSecurity #ActiveDirectory #RedTeam #Kerberos #PrivilegeEscalation #ASREP #ADCS #ESC4 #PenetrationTesting #Infosec #HackTheBox #WindowsSecurity #CTF
…

Learn MoreHack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

6 Apr, 2024

Threatninja.net

Threatninja.net

Hack The Box: Conversor Machine Walkhtrough – Easy Difficulity

Hack The Box: Mirage Machine Walkthrough – Hard Difficulity

Hack The Box: Voleur Machinen Walkthrough – Medium Difficulty

Hack The Box: Inflitrator Machine Walkthrough – Insane Difficulity

Hack The Box: Codify Machine Walkthrough – Easy Difficulty

Hack The Box: Rebound Machine Walkthrough – Insane Difficulty

Hack The Box: Builder Machine Walkthrough – Medium Difficulty

Hack The Box: Authority Machine Walkthrough – Medium Difficulty

Hack The Box: Topology Machine Walkthrough – Easy Difficulty

Threatninja.net

Threatninja.net

Tag Archives: john the ripper