HackTheBox on Hackpuntes

Logging WriteUp

Sat, 18 Jul 2026 00:00:00 +0000

Logging is a 🟧 Medium difficulty machine on Hack The Box, and it is one of those Active Directory boxes where you keep chaining one flaw after another until you own the whole domain. We start by reading a plaintext password someone left lying around in a log, we abuse permissions over a gMSA account to grab its hash, we jump to another user with a DLL hijacking in a scheduled task, and to finish we request an ADCS certificate via ESC1 and impersonate a WSUS server to run code as SYSTEM on the Domain Controller. It sounds like a lot, but we are going to take it slow and go bit by bit.

CCTV WriteUp

Sat, 11 Jul 2026 00:00:00 +0000

CCTV is a 🟩 Easy machine on Hack The Box. It chains a SQL Injection in ZoneMinder to obtain SSH credentials, with the discovery of internal video surveillance services after pivoting from the compromised machine. Escalation to root is achieved through an authenticated RCE in motionEye.

IP: 10.129.3.35
Approximate time: ~1.5h

🗺️ Attack Chain

Nmap → Port 80 (ZoneMinder 1.37.63)
│
▼
Default credentials admin:admin → panel access
│
▼
CVE-2024-51482 (Boolean SQLi) → sqlmap → mark:opensesame
│
▼
SSH as mark
│
▼
LinPEAS → tcpdump (cap_net_raw) + internal ports
│
▼
Port Forwarding → motionEye 0.43.1b4 on :8765
│
▼
/etc/motioneye/motion.conf → admin:989c5a8ee87a0e9521ec81a79187d162109282f0
│
▼
CVE-2025-60787 (Metasploit RCE) → root 🏴

🔍 Reconnaissance

Port Scanning

echo "10.129.3.35 cctv.htb" | sudo tee -a /etc/hosts
sudo nmap -p- --open -Pn --min-rate 5000 -oA ports -vvv cctv.htb
grep -oP '\d+/open' ports.gnmap | cut -d'/' -f1 | sort -u | tr '\n' ',' | sed 's/,$//' > ports.txt
sudo nmap -sCV -p$(cat ports.txt) -Pn -oA scan -vvv cctv.htb

Port	Service	Detail
`22`	SSH	OpenSSH 9.6p1 Ubuntu
`80`	HTTP	Apache 2.4.58 → `SecureVision CCTV`

Small attack surface. Port 22 is not vulnerable, so we focus on port 80.

DevArea WriteUp

Sat, 04 Jul 2026 00:00:00 +0000

DevArea is a 🟧 Medium machine on Hack The Box, part of Season 10, created by EmSec. It simulates a development environment with multiple exposed services: a SOAP web service running on Apache CXF/Jetty, an FTP server with anonymous access, and a Hoverfly service virtualization platform. The path chains an arbitrary file read vulnerability with API abuse to gain initial access, then exploits a critical misconfiguration in the system’s bash binary to escalate to root.

WingData WriteUp

Sat, 27 Jun 2026 00:00:00 +0000

WingData is an 🟩 Easy difficulty machine on Hack The Box, Season 10, created by WackyH4cker. The attack chain combines exploiting a vulnerable Wing FTP Server for initial access, extracting and cracking credentials from configuration files, and privilege escalation through a vulnerability in Python’s tarfile module.

🗺️ Attack Chain

Reconnaissance → Port 80 + 22
│
▼
Web enumeration → ftp.wingdata.htb (Wing FTP Server v7.4.3)
│
▼
CVE-2025-47812 → Unauthenticated RCE → Shell as wingftp
│
▼
/opt/wftpserver/Data/1/users/wacky.xml → Salted SHA-256 hash
│
▼
Hashcat (mode 1410) → Plaintext password → SSH as wacky
│
▼
sudo -l → restore_backup_clients.py (root) → CVE-2025-4517
│
▼
Malicious tar → path traversal → /etc/sudoers → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

Before we start, we add the machine IP to /etc/hosts so we can use the domain name across all tools:

NanoCorp WriteUp

Sat, 20 Jun 2026 00:00:00 +0000

NanoCorp is a 🟥 Hard difficulty machine from the Hack The Box platform. The attack chain starts at a job portal that accepts résumés in ZIP format: by packaging a malicious .library-ms file (CVE-2025-24071) we get the server, on extraction, to try to authenticate over SMB against our machine, leaking the NetNTLMv2 hash of a service account. After cracking that password, we use BloodHound to map the domain and discover a DACL abuse chain that lets us join a privileged group and reset the password of another service account with WinRM access. The final escalation exploits CVE-2024-0670 in the Checkmk monitoring agent, abusing the repair of its MSI installer to run our own script as NT AUTHORITY\SYSTEM.

VariaType WriteUp

Sat, 13 Jun 2026 00:00:00 +0000

VariaType is a 🟧 Medium difficulty machine on Hack The Box, Season 10. The attack chain starts by discovering an exposed Git repository on an internal portal, extracting credentials from the commit history, exploiting an arbitrary file write in fontTools to get a shell, moving laterally by abusing command injection in FontForge via a malicious ZIP file, and escalating to root by leveraging a path traversal in setuptools through a misconfigured sudo rule.

Facts WriteUp

Sat, 06 Jun 2026 00:00:00 +0000

Facts is a 🟩 Easy difficulty machine on Hack The Box. It chains the exploitation of a web CMS with a credential leak into a MinIO S3-compatible storage server, from which we extract a password-protected SSH private key. Privilege escalation is achieved by abusing a binary allowed via sudo.

🗺️ Attack Chain

Nmap → Port 80 (CamaleonCMS 2.9.0) + Port 54321 (MinIO)
│
▼
CVE-2025-2304 → Privilege Escalation + S3 Config Leak
│
▼
MinIO Credentials → Bucket "internal"
│
▼
.ssh/id_ed25519 (encrypted private key)
│
▼
ssh2john + john → passphrase: dragonballz → user: trivia
│
▼
sudo /usr/bin/facter → custom fact (.rb) → /bin/bash as root 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: fast discovery followed by version detection on the found ports.

Interpreter WriteUp

Sat, 30 May 2026 00:00:00 +0000

Interpreter is a 🟨 Medium difficulty machine from the Hack The Box platform, Season 10. The attack chain combines the exploitation of Mirth Connect 4.4.0 through insecure Java deserialization to obtain unauthenticated RCE, extraction of credentials from the internal database, cracking of a PBKDF2-HMAC-SHA256 hash, and privilege escalation by abusing a Flask service with Python f-string injection.

🗺️ Attack Chain

Reconnaissance → Ports 22, 80, 443
│
▼
Web Enumeration → Mirth Connect 4.4.0 (via JNLP)
│
▼
CVE-2023-43208 → Insecure Java Deserialization → RCE as mirth
│
▼
/usr/local/mirthconnect/conf/mirth.properties → DB Credentials
│
▼
MariaDB (mc_bdd_prod) → PBKDF2-HMAC-SHA256 hash of sedric
│
▼
Hashcat (mode 10900) → snowflake1 → SSH as sedric
│
▼
/usr/local/bin/notif.py → Flask + eval() in f-strings → SSTI
│
▼
SUID bash → root 🏴

🔍 Reconnaissance

/etc/hosts Configuration

Before starting, we add the machine’s IP to the /etc/hosts file:

MonitorsFour WriteUp

Sat, 23 May 2026 00:00:00 +0000

MonitorsFour is an 🟩 Easy difficulty machine on the Hack The Box platform. The attack chain starts by exploiting an IDOR endpoint with PHP loose comparison to leak administrator credentials, continues with remote code execution in Cacti 1.2.28 via CVE-2025-24367, and ends by escaping the Docker container by abusing the daemon API exposed without authentication on the internal Docker Desktop subnet (CVE-2025-9074).

🗺️ Attack Chain

Reconnaissance → Ports 80, 5985
│
▼
Subdomain enumeration → cacti.monitorsfour.htb
│
▼
IDOR + PHP Type Juggling → /api/v1/user?token=0 → MD5 hash → marcus:wonderful1
│
▼
CVE-2025-24367 → Cacti 1.2.28 authenticated RCE → www-data in Docker container
│
▼
user.txt → /home/marcus/user.txt
│
▼
CVE-2025-9074 → Docker API on 192.168.65.7:2375 → container with C:\ mounted → root 🏴

🔍 Reconnaissance

/etc/hosts Setup

echo "10.129.38.79 monitorsfour.htb" | sudo tee -a /etc/hosts

Port Scanning

Phase 1 - Fast TCP port discovery:

Pterodactyl WriteUp

Sat, 16 May 2026 00:00:00 +0000

Pterodactyl is a 🟧 Medium difficulty Linux machine on Hack The Box, part of Season 10 (week 2). The name is no coincidence — the main attack vector is Pterodactyl Panel, a popular open-source game server manager widely deployed on the internet. The attack chain combines an unauthenticated path traversal that exposes PEAR and enables RCE, followed by database credential extraction, bcrypt hash cracking to pivot to an SSH user, and root escalation by chaining CVE-2025-6018 (PAM) with CVE-2025-6019 (udisks2/libblockdev).

Overwatch WriteUp

Sat, 09 May 2026 00:00:00 +0000

Overwatch is a 🟧 Medium difficulty machine on the Hack The Box platform. The attack chain involves enumerating an SMB share accessible with a guest account to obtain a .NET binary with embedded credentials, connecting to an MSSQL server on a non-standard port to discover a misconfigured linked server, poisoning the domain DNS (ADIDNS) to intercept cleartext credentials of a service account, accessing via WinRM and escalating privileges by abusing an internal WCF service with command injection in the KillProcess method.

DarkZero WriteUp

Sat, 04 Apr 2026 00:00:00 +0000

DarkZero is a 🟥 Hard difficulty machine on the Hack The Box platform that simulates an enterprise Active Directory environment with two separate domains, multihoming, and advanced attack vectors. The ultimate goal is to fully compromise both Domain Controllers.

At the start, we are given initial credentials: 🔑 john.w:RFulUtONCOL!

🗺️ Attack Chain

Before diving into the details, here is the full attack chain at a glance:

john.w credentials
│
▼
MSSQL DC01 (guest) ──linked server──► MSSQL DC02 (sysadmin)
│
▼
xp_cmdshell ► Shell as svc_sql on DC02 (172.16.20.2)
│
▼
Ligolo-MP ► Access to internal network 172.16.20.0/24
│
▼
AD CS (Certify) ► NTLM hash of svc_sql ► Password change
│
▼
RunasCs (LogonType 5) ► SeImpersonatePrivilege
│
▼
SigmaPotato ► NT AUTHORITY\SYSTEM on DC02
│
▼
Rubeus monitor + xp_dirtree ► DC01$ TGT
│
▼
Pass-the-Ticket ► secretsdump ► DC01 Administrator hash
│
▼
evil-winrm ► Administrator on DC01 🏴

🔍 Reconnaissance

Port Scanning

We perform reconnaissance in two phases: first we quickly discover open ports, then we run detection scripts against them.

HTB Machine BountyHunter

Sat, 20 Nov 2021 00:00:00 +0000

Overview

Welcome to the writeup of the bountyhunter machine of the Hack The Box platform. BountyHunter is a Linux based machine that was active since July 24th to November 20th, on this machine we will find a XXE vulnerability and use it with a php wrapper to read internal files and get sensitive information, with the information gotten we will be able to connect to the machine through SSH, once inside the machine we will analyze a python script to find how we can abuse it to get code execution as root user and finish with the machine.

HTB Machine Explore

Sat, 30 Oct 2021 00:00:00 +0000

Welcome to the writeup of the explore machine of the Hack The Box platform. Explore is an easy difficulty machine on android.

Before starting

Connect to Hack The Box VPN in background with TMUX

tmux new -s htb
sudo openvpn ~/.vpn/htb.ovpn

Add machine to /etc/hosts file, check connection with ping and create work folders

echo '10.10.10.247 explore.htb' >> /etc/hosts
ping -c 4 explore.htb
mkdir -p ~/htb/explorer.htb/{exploits,fuzz,http,nmap}

Recon

Check all open ports, detect the service and its version with nmap

HTB Chaos Writeup

Sat, 25 May 2019 00:00:00 +0000

Hello everyone,

With this post we’re starting a new series where we’ll learn how to exploit vulnerable machines and solve hacking challenges.

We’re kicking things off with the latest retired machine from Hack The Box , Chaos.

For those who don’t know HTB, it’s a pentesting lab that provides different machines and challenges for its users. I usually recommend these types of platforms because they let us learn different technologies by tackling them head on.