• Search for:

    Tag Archives: Linux

    1. Home  - 
    2. Posts tagged "Linux"
    15 Aug, 2026
    HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty
    Insane Machine , , , , , , , , , , , , , , , , ,

    Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.

    Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.

    Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.

    #HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 …

    Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

    1 Aug, 2026
    Hack The Box: Kobold Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , , , , , ,

    Completed the Hack The Box “Kobold” machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation.

    The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services.

    #HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #Docker #VulnerabilityManagement #CVE #EthicalHacking #CybersecurityLearning …

    Learn MoreHack The Box: Kobold Machine Walkthrough – Easy Difficulty

    25 Jul, 2026
    Hack The Box: Fries Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , , , , , , , , , , ,

    Just wrapped up another Hack The Box machine: Fries (Hard).

    TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

    #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF …

    Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty

    11 Jul, 2026
    Hack The Box: CCTV machine walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , ,

    Just completed the CCTV machine from Hack The Box!

    After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

    For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

    Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

    #HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

    Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

    4 Jul, 2026
    Hack The Box: DevArea Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , , , ,

    Just completed the DevArea machine from Hack The Box!

    After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

    For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

    Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

    #HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking …

    Learn MoreHack The Box: DevArea Machine Walkthrough – Medium Difficulty

    27 Jun, 2026
    Hack The Box: Wingdata Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , ,

    I recently completed the Wingdata machine on Hack The Box! This easy-rated challenge involved exploiting an unauthenticated command injection vulnerability (CVE-2025-47812) in the Wing FTP Server web client to gain initial access as the wingftp user. After enumerating the system and cracking a SHA-256 password hash from a user configuration file using Hashcat, I escalated to the wacky user.

    Finally, I leveraged a vulnerable Python backup restoration script by injecting a malicious tarball containing my SSH public key, achieving full root access. A great box for practicing web application exploitation, password cracking, and creative privilege escalation techniques.

    #HackTheBox #PenetrationTesting #CyberSecurity #EthicalHacking #PrivilegeEscalation …

    Learn MoreHack The Box: Wingdata Machine Walkthrough – Easy Difficulty

    17 Jun, 2026
    Hack The Box: Abducted Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , ,

    Recently completed the Abducted machine from Hack The Box, a Medium-difficulty challenge that combined SMB enumeration, Samba exploitation, credential discovery, lateral movement, and Linux privilege escalation techniques.

    The path to user access involved enumerating SMB shares and anonymous RPC services before exploiting a vulnerable Samba printer configuration to gain an initial foothold. Further enumeration revealed backup credentials stored within an Rclone configuration file, which were decrypted and reused to obtain access as a legitimate user. From there, a misconfigured Samba share enabled lateral movement to another account, ultimately leading to a systemd-based privilege escalation path and root access.

    This machine provided valuable practice in chaining multiple weaknesses together and demonstrated how exposed credentials, insecure service configurations, and share misconfigurations can collectively lead to full system compromise.

    Key takeaways:
    ✅ SMB and RPC enumeration can reveal valuable attack paths
    ✅ Exposed credentials often provide opportunities for lateral movement
    ✅ Misconfigured Samba shares can introduce serious security risks
    ✅ Service configuration weaknesses can lead to privilege escalation
    ✅ Small misconfigurations can be chained into complete system compromise

    #CyberSecurity #EthicalHacking #PenetrationTesting #PrivilegeEscalation #RedTeam #LinuxSecurity #SMB #Samba #CTF #HackTheBox #InfoSec #SecurityResearch …

    Learn MoreHack The Box: Abducted Machine Walkthrough – Medium Difficulty

    13 Jun, 2026
    Hack The Box – VariaType Machine Walkthrough Medium Difficulty
    Medium Machine , , , , , , , , , , , , , ,

    Recently completed a Medium-difficulty machine that combined web exploitation, file-processing abuse, and privilege escalation techniques.

    The path to user access involved leveraging a vulnerable backend font-processing workflow and a ZIP-based exploitation chain to obtain a reverse shell and pivot to a legitimate user account. From there, further enumeration uncovered a misconfigured sudo rule that allowed privilege escalation to root through a Python-based validation script.

    This machine provided valuable practice in identifying attack paths, chaining vulnerabilities, and understanding how seemingly minor misconfigurations can lead to full system compromise.

    Key takeaways:
    ✅ Thorough enumeration is critical
    ✅ File-processing functionality can introduce unexpected attack surfaces
    ✅ Misconfigured sudo permissions remain a common privilege-escalation vector

    #CyberSecurity #EthicalHacking #PenetrationTesting #PrivilegeEscalation #RedTeam #LinuxSecurity #CTF #HackTheBox #InfoSec #SecurityResearch …

    Learn MoreHack The Box – VariaType Machine Walkthrough Medium Difficulty

    6 Jun, 2026
    Hack The Box: Facts Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , , ,

    Completed the Facts machine from Hack The Box, an easy-rated Linux challenge that combined web exploitation, cloud storage enumeration, SSH key recovery, and privilege escalation.

    The initial foothold came from exploiting CVE-2025-2304, a mass assignment vulnerability in Camaleon CMS 2.9.0, which allowed privilege escalation from a low-privileged user to administrator. Access to the administration panel exposed S3 configuration details and credentials, leading to enumeration of an internal bucket containing an encrypted SSH private key. After recovering the key’s passphrase with John the Ripper, SSH access as the trivia user was obtained.

    Privilege escalation to root involved abusing facter, a Ruby-based utility executable via sudo without a password. By leveraging its –custom-dir option to load a malicious custom fact, arbitrary commands were executed as root, resulting in full system compromise.

    A great machine that highlights the impact of insecure parameter handling, cloud storage exposure, and the risks associated with misconfigured sudo privileges.

    #HackTheBox #HTB #Facts #CyberSecurity #PenetrationTesting #EthicalHacking #RedTeam #PrivilegeEscalation #Linux #AWS #S3 #CamaleonCMS #CVE20252304 #JohnTheRipper #Ruby #Infosec #CTF #CyberSecurityLearning …

    Learn MoreHack The Box: Facts Machine Walkthrough – Easy Difficulty

    30 May, 2026
    Hack The Box:Interpreter Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , ,

    Completed Hack The Box machine “Interpreter” after exploiting CVE-2023-43208 in NextGen Healthcare Mirth Connect 4.4.0. Initial access involved API enumeration, unsafe Java deserialization exploitation, reverse shell execution, and database credential extraction from Mirth Connect configuration files. Cracking the recovered PBKDF2-HMAC-SHA256 hash provided SSH access as sedric and access to the user flag.

    Privilege escalation involved enumerating a root-owned Flask notification service vulnerable to Server-Side Template Injection (SSTI). By forwarding the internal service over SSH and crafting a malicious XML payload, remote command execution as root was achieved, leading to retrieval of the root flag.

    #HackTheBox #HTB #CyberSecurity #RedTeam #EthicalHacking #PenetrationTesting #OffensiveSecurity #WebSecurity #PrivilegeEscalation #SSTI #Deserialization #Linux #InfoSec #CVE202343208 …

    Learn MoreHack The Box:Interpreter Machine Walkthrough – Medium Difficulty