Recently, I completed the “Sorcery” machine on Hack The Box (Insane difficulty), which provided a deep, multi-layered challenge combining modern web exploitation, internal pivoting, and complex privilege escalation.

The attack began with reconnaissance of a self-hosted Gitea instance, where exposed source code revealed the application architecture. This led to identifying a Cypher injection vulnerability in functionality backed by Neo4j, which enabled SSRF to leak sensitive data such as password hashes and a registration key. After gaining seller access, a stored XSS payload was used to hijack an admin session and access a restricted debug feature. This interface allowed interaction with internal services, ultimately achieving remote code execution via a Kafka-based payload. From there, pivoting with Ligolo-ng exposed internal services, including an FTP server containing an encrypted private key, which was cracked offline to gain SSH access and retrieve the user flag.

Privilege escalation required chaining multiple subtle misconfigurations. A running Xvfb instance exposed a screen dump containing credentials for a higher-privileged user. With limited sudo access, strace was used to capture plaintext credentials from running processes. Further enumeration revealed activity tied to FreeIPA, where identity management controls were abused to gain full sudo privileges. After applying the changes, this ultimately led to root access and full system compromise.

#HackTheBox #CyberSecurity #PenetrationTesting #RedTeam #EthicalHacking #CTF #Infosec #PrivilegeEscalation #WebSecurity …

Learn MoreHack The Box: Sorcery Machine Walkthrough – Insane Difficulty