ssh Archives - Page 3 of 14

21 Jun, 2025

Hack The Box: Titanic Machine Walkthrough – Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2024-41817, directory traversal, HackTheBox, ImageMagick, Linux, Penetration Testing, python3, ssh

Just wrapped up a detailed walkthrough of the Hack The Box Titanic machine — an easy-rated challenge packed with valuable learning opportunities!

The journey started with exploiting a directory traversal vulnerability to access sensitive Gitea configuration files and extract user credentials. From there, I gained SSH access as the developer user and retrieved the user flag.

Privilege escalation was achieved by exploiting a critical ImageMagick vulnerability (CVE-2024-41817) in a writable directory, allowing arbitrary code execution via a crafted shared library. I also discovered the developer user had unrestricted sudo privileges, providing a straightforward path to root.

#HackTheBox #CyberSecurity #Pentesting #CTF #PrivilegeEscalation #LinuxSecurity #ImageMagick #CVE202441817 #EthicalHacking #DirectoryTraversal

…

Learn MoreHack The Box: Titanic Machine Walkthrough – Easy Difficulty

7 Jun, 2025

Hack The Box: Backfire Machine Walkthrough – Medium Difficulty

Medium Machine Challenges, CVE-2024-41570, HackTheBox, Havoc C2, iptables, iptables-save, jwt, Linux, Penetration Testing, port forwarding, python3, ssh

Successfully rooted another Hack The Box machine by chaining multiple vulnerabilities across custom C2 frameworks. For the user flag, we exploited an SSRF vulnerability (CVE-2024-41570) in the Havoc C2 framework to access internal services, which we then chained with an authenticated RCE to execute arbitrary commands and gain a reverse shell as the ilya user. To maintain stable access, SSH keys were added for persistence, allowing us to retrieve the user.txt flag. For the root flag, we targeted the Hardhat C2 service by forging a valid JWT with a Python script to create an admin user, which provided shell access as sergej. Upon privilege escalation analysis, we found that sergej had sudo access to the iptables-save binary. This was abused to overwrite the /etc/sudoers file and escalate to root, ultimately retrieving the root.txt flag. Another great learning experience on the path to mastering offensive security!

#HackTheBox #CyberSecurity #InfoSec #RedTeam #CTF #PrivilegeEscalation #RCE #SSRF #Linux #HTB #EthicalHacking #PenetrationTesting #HavocC2 #HardhatC2 #JWT #SudoExploit #OSCP #BugBounty …

Learn MoreHack The Box: Backfire Machine Walkthrough – Medium Difficulty

31 May, 2025

Hack The Box: Checker Machine Walkthrough – Hard Difficulty

Hard Machine BookStack, BurpSuite, Challenges, CVE-2023-1545, CVE-2023-6199, gobuster, HackTheBox, Linux, OTP, Penetration Testing, python3, ssh, Teampass

Successfully exploited CVE-2023-1545 in Teampass to extract user credentials and leveraged CVE-2023-6199 in BookStack to obtain an OTP, gaining user-level access on the Checker machine. Privilege escalation was achieved by exploiting a sudo script interacting with shared memory, setting the SUID bit on /bin/bash to capture the root flag. A great example of combining application vulnerabilities with creative privilege escalation techniques!

#Cybersecurity #EthicalHacking #HackTheBox #PenetrationTesting #InfoSec #VulnerabilityResearch #PrivilegeEscalation #CTF #SecurityResearch …

Learn MoreHack The Box: Checker Machine Walkthrough – Hard Difficulty

17 May, 2025

Hack The Box: Heal Machine Walkthrough – Medium Difficulty

Medium Machine BurpSuite, Challenges, consul, HackTheBox, hashcat, jwt, LimeSurvey, Linux, Path Traversal, Penetration Testing, port forwarding, rails, ruby, sqlite3, ssh

Writeup Summary: Heal (Hack The Box)

This box involved thorough enumeration that uncovered multiple subdomains, including a Ruby on Rails API. Initial access was gained by chaining a Local File Inclusion vulnerability with password cracking and exploiting a LimeSurvey plugin upload vulnerability. Privilege escalation was achieved by identifying and exploiting an exposed Consul service accessible through SSH port forwarding.

This challenge showcased key red teaming skills: web application exploitation, misconfiguration abuse, credential harvesting, and lateral movement.

#HackTheBox #CyberSecurity #RedTeam #PrivilegeEscalation #BugBounty #WebSecurity #Infosec #CTF #HTB #OffensiveSecurity #LinuxExploitation …

Learn MoreHack The Box: Heal Machine Walkthrough – Medium Difficulty

12 Apr, 2025

Hack The Box: LinkVortex Machine Walkthrough Easy Difficulty

Easy Machine BurpSuite, Challenges, CVE-2023-40028, GhostCMS, GitDumper, HackTheBox, Linux, Local File Inclusion, Penetration Testing, ssh, SudoMisconfiguration

Successfully demonstrated advanced cybersecurity skills by exploiting a Ghost CMS vulnerability (CVE-2023-40028) to access sensitive credentials and secure the user flag. Identified and leveraged a sudo misconfiguration with the CHECK_CONTENT variable to escalate privileges and retrieve the root flag from /root/root.txt. Thrived in this hands-on challenge, sharpening penetration testing expertise! #HackTheBox #Cybersecurity #EthicalHacking #PenetrationTesting #CTF …

Learn MoreHack The Box: LinkVortex Machine Walkthrough Easy Difficulty

5 Apr, 2025

Hack The Box: Ghost Machine Walkthrough – Insane Difficulty

Insane Machine adfs abuse attack, ADFSDump, ADFSSpoof, Bloodhound, BloodHoundCE, BurpSuite, Challenges, command injection, docker, efspotatoo, evil-winrm, Gitea, HackTheBox, hashcat, JokerShell, kerberos, LFI, Linux, mimkatz, Penetration Testing, responder, rubeus.exe, SQL, ssh

The initial foothold was gained by exploiting command injection on intranet.ghost.htb:8008/api-dev/scan/, which provided a reverse shell inside a Docker container. From there, I enumerated the environment and discovered credentials that allowed SSH access as Florence Ramirez. By extracting and converting a Kerberos ticket, I authenticated as a legitimate user, escalating access within the system. With access to the Windows environment, I retrieved NTLM hashes for the adfs_gmsa account and leveraged evil-winrm for lateral movement. A reverse shell was established using JokerShell, and privileges were escalated by enabling xp_cmdshell through a debug interface. After uploading EfsPotato.cs and disabling antivirus, I used Mimikatz and Rubeus.exe to dump credentials, ultimately achieving SYSTEM access. This led to the extraction of domain admin credentials and the retrieval of the root flag. Another Insane box down! 💀💻

#HackTheBox #RedTeam #CyberSecurity #PenTesting #PrivilegeEscalation #EthicalHacking …

Learn MoreHack The Box: Ghost Machine Walkthrough – Insane Difficulty

29 Mar, 2025

Hack The Box: BlockBlock Machine Walkthrough – Hard Difficulty

Hard Machine Authentication Bypass, BurpSuite, Challenges, Ethereum Classic Exploit, Forge Binary Privilege Escalation, HackTheBox, JSON-RPC Vulnerability, JWT Token Extraction, Linux, Pacman Package Manager Misconfiguration, Penetration Testing, ssh, XSS Attack

This walkthrough examines the BlockBlock machine from Hack The Box, classified as a medium-difficulty challenge. The assessment began with the exploitation of an XSS vulnerability, which facilitated credential theft through the Ethereum JSON-RPC API, granting SSH access. Privilege escalation was achieved by leveraging the forge binary to obtain higher privileges, followed by exploiting a misconfigured pacman package manager to gain root access. This engagement underscores the critical importance of securing APIs, implementing robust input validation, and enforcing strict privilege escalation controls to mitigate security risks.

#HackTheBox #CyberSecurity #PenetrationTesting #CTF #EthicalHacking #XSS #PrivilegeEscalation #BlockchainSecurity …

Learn MoreHack The Box: BlockBlock Machine Walkthrough – Hard Difficulty

1 Mar, 2025

Threatninja.net

Threatninja.net

Hack The Box: Titanic Machine Walkthrough – Easy Difficulty

Hack The Box: Backfire Machine Walkthrough – Medium Difficulty

Hack The Box: Checker Machine Walkthrough – Hard Difficulty

Hack The Box: Heal Machine Walkthrough – Medium Difficulty

Hack The Box: LinkVortex Machine Walkthrough Easy Difficulty

Hack The Box: Ghost Machine Walkthrough – Insane Difficulty

Hack The Box: BlockBlock Machine Walkthrough – Hard Difficulty

Hack The Box: Instant Machine Walkthrough – Medium Difficulty

Hack The Box: Yummy Machine Walkthrough – Hard Difficulty

HackTheBox:MagicGardens Machine Walkthrough-Insane Difficulty

Threatninja.net

Threatninja.net

Tag Archives: ssh