Writeups
HackTheBox, TryHackMe and Vulnhub boxes.
HackTheBox - Interpreter writeup (Linux/Medium)
Interpreter is a medium Linux box from season 10, running a MirthConnect instance vulnerable to CVE-2023-43208 which gives unauthenticated RCE, I used that to get a shell, found credentials for sed...
HackTheBox - Conversor writeup (Linux/Easy) - unintended user path with 2 ways to root
conversor is an easy linux machine that involves web enumeration leading to a source code leak. The source code reveals a file upload path traversal vulnerability, which is exploited to write a Pyt...
HackTheBox - Expressway writeup (Linux/Easy)
expressway is an easy Linux box running isakmp over UDP. By abusing aggressive mode, I cracked the pre-shared key and used it to authenticate via SSH. During post-exploitation, I discovered two dis...
HackTheBox - Guardian writeup (Linux/Hard)
guardian is a hard Linux box, hosting a php based university website, this writeup involved leveraging default student credentials, session hijacking via CVE-2025-22131 (XSS) in phpspreadsheet, and...
HackTheBox - Giveback writeup (Linux/Medium)
Giveback is a medium Linux box from season 9, hosting a wordpress website on a kubernetes setup with a vulnerable plugin, which gives remote code execution on the wordpress pod, from there I found ...
HackTheBox - Soulmate writeup (Linux/Easy)
soulmate is an easy Linux box running a crushftp instance vulnerable to CVE-2025-31161 auth bypass, I took advantage of it to add a new superuser so I can upload a revshell and get a shell as www-d...
HackTheBox - Signed writeup (Windows/Medium) - with unintended root
signed is an assume-breach medium windows box from season 9, where I was given the credentials of scott, I was able to leak mssqlsvc netntlmv2 hash using xp_dirtree and crack it, then use the crede...
HackTheBox - CodePartTwo writeup (Linux/Easy)
CodePartTwo is an easy Linux box, hosting an open source js2py sandbox vulnerable to RCE via CVE-2024-28397 sandbox escape, I exploited the CVE to gain initial foothold as app then cracked hashes i...
HackTheBox - Imagery writeup (Linux/Medium)
Imagery is a medium Linux box, running a Flask Python application, I exploited a stored XSS to steal the admin cookie and log in as admin on the website, then exploited an LFI in the admin panel to...
HackTheBox - Editor writeup (Linux/Easy)
editor is an easy Linux machine with SSH open. It runs an old version of xwiki on top of a Jetty web server. I exploited CVE-2025-24893 to gain a foothold from xwiki. Once inside, I found SSH crede...
HackTheBox - Era writeup (Linux/Medium) - unintended root path
Era is a medium Linux box that highlights the danger of loose PHP wrapper implementations. The foothold involves enumerating a file storage vhost to exploit a logic flaw in password recovery, leadi...
HackTheBox - Mirage writeup (Windows/Hard) - user part
mirage is hard windows machine where I only could get the user flag before it retired, for the foothold I hijacked an internally used dns entry and got initial user creds by tricking a user to conn...
HackTheBox - Outbound writeup (Linux/Easy)
outbound is an assume-breach easy linux box where I was given the credentials of tyler, I used his credentials to get a shell as www-data by exploiting CVE_2025_49113, an authenticated RCE in round...
HackTheBox - voleur writeup (windows/Medium)
voleur is an assume-breach medium windows box running active directory services with ntlm auth disabled as well as a linux instance running on wsl, where I was given the credentials of ryan.naylor,...
HackTheBox - Artificial writeup (Linux/Easy)
artificial is an easy linux machine, hosting a website to upload and run tenserflow models, I got foothold by uploading and running a model with a malicious lambda layer, once inside I cracked some...
HackTheBox - tombwatcher writeup (Windows/Medium)
tombwatcher is an assume-breach medium windows box where I was given the credentials of henry, from there I exploited 6 AD DACL mis-configuations to get the user flag, for priv esc restored a delet...
HackTheBox - puppy writeup (Windows/Medium)
puppy is an assume-breach medium windows box where you’re given the credentials of levi.james, I started with exploiting a GenericWrite to add my user to the DEVELOPERS groups and gain access to t...
HackTheBox - planning writeup (Linux/Easy)
planning is an assume-breach box where you’re given the credentials of admin, which at first is not apparent where to use them. The box had a Grafana instance running that was vulnerable to CVE-202...
HackTheBox - fluffy writeup (Windows/Easy)
fluffy is an assume-breach box where you’re given the credentials of j.fleischman, for this box I exploited CVE-2025-24071 to get p.agila’s credentials, then I abused a few GenericWrites to work my...
Vulnhub - hackerkid writeup (Linux/Medium)
for this box, I exploited an XXE to get web credentials for tornado, then achieved code execution trough exploiting an SSTI, after getting a shell I injected a stager shellcode I wrote into a root ...
HackTheBox - Codify writeup (Linux/Easy)
Codify recon I ran a simple nmap scan to find out port 22, 80 and 3000 are running on the machine $ nmap 10.10.11.239 Starting Nmap 7.94 ( https://nmap.org ) at 2023-11-28 13:40 +01 Nmap scan re...
HackTheBox - Pilgrimage writeup (Linux/Easy)
pilgrimage recon examining the I ran a simple nmap scan to find out port 22 and 80 are running on the machine $ nmap -v -oN ports -v 10.10.11.219 # Nmap 7.94 scan initiated Sat Jul 8 20:01:58 ...
TryHackMe - b3dr0ck writeup (Linux/Easy)
b3dr0ck recon I added the machine’s IP to my /etc/hosts as bedrock.thm then ran an nmap scan to find ssh and http ports open $ sudo nmap bedrock.thm -v PORT STATE SERVICE 22/tcp open ssh...
TryHackMe - Hacker vs Hacker writeup (Linux/Easy)
recon I added the machine’s IP to my /etc/hosts as nope.thm then ran an nmap scan to find ssh and http ports open $ sudo nmap nope.thm -v PORT STATE SERVICE 22/tcp open ssh 80/tcp open http...
HackTheBox - Openadmin writeup (Linux/Easy)
recently, hackthebox started an event called take it easy, where it made a bunch of retired easy machine accessible to everyone, so here’s my write up for the first box I’ve rooted in the event Re...
TryHackMe - Skynet writeup (Linux/Easy)
about the machine skynet is an easy-rated machine from TryHackMe with the themes being samba/http enumeration and file inclusion Reconnaissance As always I added the box to my /etc/hosts file as...
TryHackMe - Looking Glass writeup (Linux/Medium)
about the machine this is the second medium-rated machine from wonderland series on tryhackme, a sequel to the wonderland challenge Reconnaissance I added the box ip to my hosts file then a ran a...
TryHackMe - Mr Robot writeup (Linux/Medium)
about the machine this is a medium rated box from tryhackme, thought a little too easy if you asked me Reconnaissance I added the box ip to my hosts file then a ran a quick nmap scan # Nmap 7.91...
TryHackMe - Wonderland writeup (Linux/Medium)
about the machine this is a medium rated machine from wonderland series, which happens to be the first series I try to get root on Reconnaissance first thing I did is adding the box ip to my host...