PHP Archives - Threatninja.net

6 Sep, 2025

Hack The Box: Environment Machine Walkthough-Medium Difficulty

Medium Machine BurpSuite, Challenges, cve-2024-21546, CVE-2024-52301, GnuPG key, gobuster, HackTheBox, lavarel, Linux, Penetration Testing, PHP, python3, ssh, systeminfo

Environment HTB: Full User & Root Flag Capture Through Exploitation

Captured both the user and root flags on the Environment HTB machine! We exploited Laravel 11.30.0 (PHP 8.2.28) vulnerabilities, including argument injection (CVE-2024-52301) and UniSharp Laravel Filemanager code injection. By bypassing authentication with `–env=preprod` and leveraging the profile upload feature, we executed a PHP reverse shell and retrieved the user flag via `cat user.txt`. For root access, we decrypted `keyvault.gpg` from the `.gnupg` directory to obtain credentials and exploited sudo with preserved BASH\_ENV by crafting a script that spawned a privileged shell, ultimately gaining full control of the system.

#CyberSecurity #HTB #PenTesting #EthicalHacking #LaravelExploits #PrivilegeEscalation #PHP #Infosec #BugBounty #RedTeam
…

Learn MoreHack The Box: Environment Machine Walkthough-Medium Difficulty

12 Jul, 2025

Hack The Box: Dog Machine Walkthrough (Easy Difficulty)

Easy Machine Backdrop, bee, BurpSuite, Challenges, command injection, CVE-2024-41709, git-dumper, HackTheBox, Linux, Penetration Testing, PHP, pwncat-cs, reverse shell

1 Feb, 2025

Hack The Box: Trickster Machine Walkthrough – Medium Difficulty

Medium Machine .br extension, brotli, BurpSuite, Challenges, Changedetection.io, CVE-2024-32651, CVE-2024-34716, docker escape, ffuf, git, git-dumper, gobuster, HackTheBox, hashcat, Linux, MySQL, Penetration Testing, PHP, port forwarding, PrestraShop CMS, PrusaSlicer, ssh, ssti

11 Jan, 2025

Hack The Box: Sightless Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2022-0944, docker, Froxlor, HackTheBox, hashcat, Linux, Penetration Testing, PHP, PHP-FPM, port forwarding, python3, SQLPad, ssh

1 Jun, 2024

Hack The Box: Analysis Machine Walkthrough – Hard Difficulty

Hard Machine BurpSuite, Challenges, evil-winrm, gobuster, HackTheBox, kerbrute, msfvenom, NetExec, Penetration Testing, PHP, PowerShell, snort, ssh, Windows

29 Jul, 2023

Hack The Box: Cerberus Machine Walkthrough – Hard Difficulty

Hard Machine ADSelfService, BurpSuite, Challenges, chisel, domain sharing, evil-winrm, firejoin.py, HackTheBox, hashcat, icinga, Linux, msfconsole, Path Injection, Penetration Testing, PHP, ssh, SSH key, Windows, winpeas

11 Jun, 2023

Hack The Box: Soccer Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, doas, dstat, gobuster, HackTheBox, Linux, Penetration Testing, PHP, python3, sqlmap, ssh, tiny filemanager, websocket

13 May, 2023

Hack The Box: Interface Machine Walkthrough – Medium Difficulty

Medium Machine API, BurpSuite, Challenges, dompdf, ffuf, HackTheBox, Linux, Penetration Testing, PHP, pspy64, python3

29 Apr, 2023

Hack The Box: Metatwo Machine Walkthrough – Easy Difficulty

Easy Machine Challenges, curl, file upload, ftp, HackTheBox, hashcat, Linux, OpenPGP, passpie, Penetration Testing, PHP, php server, plugin, SQL Injection, ssh, Wordpress, wpscan

15 Apr, 2023

Hack The Box: Encoding Machine – Medium Difficulty

Medium Machine API, BurpSuite, Challenges, curl, disearch, git, git-dumper, gobuster, HackTheBox, Linux, Penetration Testing, PHP, php_filter_chain_generator, pwncat-cs, python3