• Search for:

    Tag Archives: python3

    1. Home  - 
    2. Posts tagged "python3"
      3. ( Page3 )
    21 Jun, 2025
    Hack The Box: Titanic Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , ,

    Just wrapped up a detailed walkthrough of the Hack The Box Titanic machine — an easy-rated challenge packed with valuable learning opportunities!

    The journey started with exploiting a directory traversal vulnerability to access sensitive Gitea configuration files and extract user credentials. From there, I gained SSH access as the developer user and retrieved the user flag.

    Privilege escalation was achieved by exploiting a critical ImageMagick vulnerability (CVE-2024-41817) in a writable directory, allowing arbitrary code execution via a crafted shared library. I also discovered the developer user had unrestricted sudo privileges, providing a straightforward path to root.

    #HackTheBox #CyberSecurity #Pentesting #CTF #PrivilegeEscalation #LinuxSecurity #ImageMagick #CVE202441817 #EthicalHacking #DirectoryTraversal

    …

    Learn MoreHack The Box: Titanic Machine Walkthrough – Easy Difficulty

    7 Jun, 2025
    Hack The Box: Backfire Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , ,

    Successfully rooted another Hack The Box machine by chaining multiple vulnerabilities across custom C2 frameworks. For the user flag, we exploited an SSRF vulnerability (CVE-2024-41570) in the Havoc C2 framework to access internal services, which we then chained with an authenticated RCE to execute arbitrary commands and gain a reverse shell as the ilya user. To maintain stable access, SSH keys were added for persistence, allowing us to retrieve the user.txt flag. For the root flag, we targeted the Hardhat C2 service by forging a valid JWT with a Python script to create an admin user, which provided shell access as sergej. Upon privilege escalation analysis, we found that sergej had sudo access to the iptables-save binary. This was abused to overwrite the /etc/sudoers file and escalate to root, ultimately retrieving the root.txt flag. Another great learning experience on the path to mastering offensive security!

    #HackTheBox #CyberSecurity #InfoSec #RedTeam #CTF #PrivilegeEscalation #RCE #SSRF #Linux #HTB #EthicalHacking #PenetrationTesting #HavocC2 #HardhatC2 #JWT #SudoExploit #OSCP #BugBounty …

    Learn MoreHack The Box: Backfire Machine Walkthrough – Medium Difficulty

    31 May, 2025
    Hack The Box: Checker Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , ,

    Successfully exploited CVE-2023-1545 in Teampass to extract user credentials and leveraged CVE-2023-6199 in BookStack to obtain an OTP, gaining user-level access on the Checker machine. Privilege escalation was achieved by exploiting a sudo script interacting with shared memory, setting the SUID bit on /bin/bash to capture the root flag. A great example of combining application vulnerabilities with creative privilege escalation techniques!

    #Cybersecurity #EthicalHacking #HackTheBox #PenetrationTesting #InfoSec #VulnerabilityResearch #PrivilegeEscalation #CTF #SecurityResearch …

    Learn MoreHack The Box: Checker Machine Walkthrough – Hard Difficulty

    3 May, 2025
    HackTheBox – BigBang Machine Walkthrough (Hard Difficulty)
    Hard Machine , , , , , , , , , , , , , , , , , , , , ,

    Chained exploitation through misconfigured web app and internal services. We started by exploiting a WordPress plugin vulnerability (CVE-2023-26326) to upload files, followed by a file read vulnerability (CVE-2024-2961) for remote code execution. From there, we cracked the database credentials, gained SSH access as the shawking user, and leveraged a vulnerable API endpoint to escalate to root. This highlights how overlooked configurations and service misconfigurations can lead to a full server compromise.

    #CTF #PrivilegeEscalation #WebSecurity #CommandInjection #SSH #WordPress #LinuxPentesting #BugBounty #HackTheBox #RedTeam #CyberSecurity …

    Learn MoreHackTheBox – BigBang Machine Walkthrough (Hard Difficulty)

    22 Mar, 2025
    Hack The Box: Alert Machine Walkthrough – Easy Difficulty
    Easy Machine , , , , , , , , , , ,

    We discovered an XSS vulnerability in .md file uploads and the Contacts tab. By embedding an XSS payload and sharing the link, we extracted data from messages.php, revealing a file parameter vulnerable to LFI. This led us to /var/www/statistics.alert.htb/.htpasswd, which contained a hashed password. Using hashid, we identified it as MD5 (APR1-MD5) and cracked it with Hashcat, retrieving the password ManchesterUnited. With these credentials, we accessed the system and captured the user flag.

    After logging into statistics.alert.htb, we found port 8080 open. Using SSH port forwarding, we accessed a monitoring site but needed to locate its directory. Checking ps aux, we found it in /opt/website-monitor. We confirmed file access by testing a basic PHP file, which worked. We then uploaded a PentestMonkey reverse shell, but it didn’t execute. To ensure success, we crafted a reliable PHP shell, triggered it, and gained root access.

    🔍 #CyberSecurity #BugBounty #EthicalHacking #PenTesting #CTF #HTB #WebSecurity #XSS #LFI #PrivilegeEscalation #Hacking …

    Learn MoreHack The Box: Alert Machine Walkthrough – Easy Difficulty

    1 Mar, 2025
    Hack The Box: Instant Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , ,

    Introduction to Instant: In this writeup, we will explore the “Instant” machine from Hack The Box, which is categorized as a medium-difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective:

    Continue ReadingHack The Box: Instant Machine Walkthrough – Medium Difficulty

    22 Feb, 2025
    Hack The Box: Yummy Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , ,

    Introduction to Yummy: This write-up will explore the “Yummy” machine from Hack The Box, categorized as a Hard difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective: The goal of

    Continue ReadingHack The Box: Yummy Machine Walkthrough – Hard Difficulty

    8 Feb, 2025
    HackTheBox:MagicGardens Machine Walkthrough-Insane Difficulty
    Insane Machine , , , , , , , , , , , , , ,

    Introduction to MagicGardens: This write-up will explore the “MagicGardens” machine from Hack The Box, which is categorized as an insanely difficult challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective on

    Continue ReadingHackTheBox:MagicGardens Machine Walkthrough-Insane Difficulty

    28 Jan, 2025
    Hack The Box: Strutted Machine Walkthrough – Medium Difficulty
    Medium Machine , , , , , , , , , , ,

    Introduction to Strutted: This write-up will explore the “Strutted” machine from Hack The Box, categorized as a medium-difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective: The goal of this

    Continue ReadingHack The Box: Strutted Machine Walkthrough – Medium Difficulty

    25 Jan, 2025
    Hack The Box: Caption Machine Walkthrough – Hard Difficulty
    Hard Machine , , , , , , , , , , , ,

    Introduction to Caption: This write-up will explore the “Caption” machine from Hack The Box, which is categorized as a Hard difficulty challenge. This walkthrough will cover the reconnaissance, exploitation, and privilege escalation steps required to capture the flag. Objective: The

    Continue ReadingHack The Box: Caption Machine Walkthrough – Hard Difficulty