Craft Walkthrough Introduction This box was very real world in the chain of mistakes that lead to each exploit. The beer theme and Silicon Valley theme were also awesome. A+ box, and here’s the writeup. Information Gathering Port Scan: Nmap We begin our reconnaissance by running a port scan with Nmap, checking default scripts…

Bart Walkthrough We start with a bunch of web enumeration and discovering different directories and hostnames. Eventually, we discover a chat application, register our own user and do log poisoning to get our first low priv shell. Privilege escalation to Administrator is then accomplished by identifying AutoLogon credentials stored in the registry…

BrainFuck Walkthrough Enumeration As always, I start with an nmap scan. Nmap I checked for open ports, here are the results for the script scan on the open ports found: ┌──(user㉿KaliVM)-[/hackthebox/oscp-prep/brainfuck] └─$ sudo nmap brainfuck.htb -p 22,25,110,143,443 -sV -A -O -sC…

Fortune Walkthrough In this box, I use a simple command injection on the web fortune application that allows me to find the Intermediate CA certificate and its private key. After importing the certificates in Firefox, I can authenticate to the HTTPS page and access a privileged page that generates an SSH private…

SolidState Walkthrough Write-up for the machine SolidState from Hack The Box. Requires thorough port scanning to find an esoteric telnet admin interface of the Apache James email server. With default root credentials, you become James admin and break into people’s email inboxes. …

Active Walkthrough Active is an easy rated windows machine on hackthebox by eks and mrb3n. Groups.xml was found on a smb mount containing the encrypted credentials for a account of which the decrypting keys were public. So, the cipher was decrypted and the password was valid for the account. …

Bankrobber Writeup Bankrobber is a web app box with a simple XSS and SQL injection that we have to exploit in order to get the source code of the application and discover a command injection vulnerability in the backdoor checker page that’s only reachable from localhost. By using the XSS to make…

Summary Jarvis just retired today. Even though this is a medium box, I learned a lot from solving it, especially about systemctl and how I can abuse it to gain root privileges. Its IP address is 10.10.10.143 and I added it to /etc/hosts as jarvis.htb to make accessing the machine easier…

Tally Writeup Tally is a hard difficulty Windows Server 2016 machine on hackthebox.eu. Summary Tally can be a very challenging machine for some. It focuses on many different aspects of real Windows environments and requires users to modify and compile an exploit for escalation. …