pwncat-cs Archives - Threatninja.net

12 Jul, 2025

Hack The Box: Dog Machine Walkthrough (Easy Difficulty)

Easy Machine Backdrop, bee, BurpSuite, Challenges, command injection, CVE-2024-41709, git-dumper, HackTheBox, Linux, Penetration Testing, PHP, pwncat-cs, reverse shell

22 Mar, 2025

Hack The Box: Alert Machine Walkthrough – Easy Difficulty

Easy Machine Apache, Challenges, HackTheBox, hashcat, hashid, Linux, Markdown, Penetration Testing, port forwarding, pwncat-cs, python3, XSS

We discovered an XSS vulnerability in .md file uploads and the Contacts tab. By embedding an XSS payload and sharing the link, we extracted data from messages.php, revealing a file parameter vulnerable to LFI. This led us to /var/www/statistics.alert.htb/.htpasswd, which contained a hashed password. Using hashid, we identified it as MD5 (APR1-MD5) and cracked it with Hashcat, retrieving the password ManchesterUnited. With these credentials, we accessed the system and captured the user flag.

After logging into statistics.alert.htb, we found port 8080 open. Using SSH port forwarding, we accessed a monitoring site but needed to locate its directory. Checking ps aux, we found it in /opt/website-monitor. We confirmed file access by testing a basic PHP file, which worked. We then uploaded a PentestMonkey reverse shell, but it didn’t execute. To ensure success, we crafted a reliable PHP shell, triggered it, and gained root access.

🔍 #CyberSecurity #BugBounty #EthicalHacking #PenTesting #CTF #HTB #WebSecurity #XSS #LFI #PrivilegeEscalation #Hacking …

Learn MoreHack The Box: Alert Machine Walkthrough – Easy Difficulty

30 Sep, 2023

Hack The Box: Format Machine Walkthrough – Medium Difficulty

Medium Machine BurpSuite, Challenges, Gitea, HackTheBox, Linux, Penetration Testing, pwncat-cs, redis, redis-cli, ssh

15 Apr, 2023

Hack The Box: Encoding Machine – Medium Difficulty

Medium Machine API, BurpSuite, Challenges, curl, disearch, git, git-dumper, gobuster, HackTheBox, Linux, Penetration Testing, PHP, php_filter_chain_generator, pwncat-cs, python3

9 Apr, 2023

Hack The Box: Broscience Machine Walkthrough-Medium Difficulty

Medium Machine bash, BurpSuite, Challenges, command injection, gobuster, HackTheBox, hashes, john the ripper, Linux, openssl, Path Injection, Penetration Testing, PHP, pspy64, psql, pwncat-cs

11 Mar, 2023

Hack The Box: Mentor Machine Walkthrough – Medium Difficulty

Medium Machine API, BurpSuite, Challenges, chisel, gobuster, HackTheBox, john the ripper, json, linpeas, Linux, Penetration Testing, psql, pwncat-cs, Python, snmpwalk, ssh, sudo, wfuzz

26 Feb, 2023

Hack The Box: Awkward Machine Walkthrough – Medium Difficulty

Medium Machine API, BurpSuite, cart, Challenges, cookie, crackstation, csv file, curl, file read, gobuster, gtfobins, HackTheBox, john the ripper, jwt, jwt2john, Penetration Testing, pspy64, pwncat-cs, python3, ssh, ssrf

19 Feb, 2023

Hack The Box: Rainyday Machine Walkthrough – Hard Difficulty

Hard Machine API, Challenges, chisel, container, gobuster, HackTheBox, idor, Linux, Nmap, pspy64, pwncat-cs, python3, rainycloud, rainyday, ssh, subdomain

12 Sep, 2022

Hack The Box: UpDown Machine Walkthrough – Medium Difficulty

Medium Machine BurpSuite, Challenges, curl, easy_install, git, git-dumper, gobuster, gtfobins, HackTheBox, htaccess, Linux, Penetration Testing, phar file, php functions, pwncat-cs, source code review, ssh, SSH key

10 Sep, 2022

Hack the box: Vessel Machine Walkthrough – Hard Difficulty

Hard Machine BurpSuite, Challenges, curl, feroxbuster, git, git-dumper, HackTheBox, linpeas, Linux, Node.js, OpenWeb Analytics, Penetration Testing, pwncat-cs, SQL Injection, Vulnerabilities