WriteUps

Forest

Forest is an Easy difficulty Windows machine from HackTheBox focusing on Active Directory enumeration and exploitation. The initial foothold is gained by dumping users via an SMB Null Session and performing an AS-REP Roasting attack. Privilege escalation involves abusing the Account Operators group to gain GenericAll privileges over the Exchange Windows Permissions group, ultimately allowing for a DCSync attack to dump the domain Administrator’s hash.

1 September 2026

Blue

#EternalBlue

Blue is an easy-difficulty Windows machine on Hack The Box. Port enumeration reveals an open SMB service running on Windows 7, which is vulnerable to MS17-010 (EternalBlue). Exploiting this Remote Code Execution (RCE) vulnerability grants direct command execution as NT AUTHORITY\SYSTEM, completing the machine compromise without requiring additional privilege escalation.

23 March 2026

Apocalyst

#Steganography #Password Brute Force #Authenticated RCE #Sensitive Data Exposure #LXD Group Abuse #World-Writable File

Writeup for the Apocalyst machine (Linux - Medium). Initial access involves web fuzzing using a CeWL-generated wordlist, steganography extraction via StegSeek, and WordPress password brute-forcing to achieve Remote Code Execution. User pivoting is completed by decoding base64 credentials, followed by root privilege escalation via LXD group abuse or world-writable /etc/passwd permissions.

14 March 2026

Antique

#SNMP Information Disclosure #Command Injection #Arbitrary File Read

Antique is an easy-difficulty Linux machine on Hack The Box. Initial access is achieved by enumerating SNMP to extract encoded hex bits containing the Telnet password, which unlocks a restricted shell with an command execution function (exec) to gain a shell as the lp user. For privilege escalation, belonging to the lpadmin group is leveraged alongside an Arbitrary File Read vulnerability in CUPS v1.6.1 to retrieve the root flag directly.

22 January 2026

Cap

#Insecure Direct Object Reference (IDOR)#Cleartext Credentials #Password Reuse #Linux Capabilities Abuse

Cap is an easy-difficulty Linux machine on Hack The Box. Web enumeration reveals an Insecure Direct Object Reference (IDOR) vulnerability on a packet capture dashboard, allowing access to capture #0 containing cleartext FTP credentials. Reusing these credentials grants SSH access as user nathan. Privilege escalation to root is achieved by exploiting the cap_setuid Linux capability assigned to the python3.8 binary.

9 January 2026

Boardlight

#Default Credentials #Authenticated RCE #Password Reuse #SUID Binary Abuse

Boardlight is an easy-difficulty Linux machine on Hack The Box. Subdomain enumeration reveals a Dolibarr CRM instance (v17.0.0) accessible using default credentials. Authenticated Remote Code Execution (RCE) is obtained by exploiting CVE-2023-30253. Extracting database credentials from the configuration file enables password reuse for SSH access as user larissa. Local privilege escalation to root is achieved by exploiting a vulnerable SUID binary in the Enlightenment desktop environment (CVE-2022-37706).

9 January 2026

Blocky

#Hardcoded Credentials #Password Reuse #Information Disclosure #Sudo Misconfiguration

Blocky is an easy-difficulty Linux machine on Hack The Box. Web directory enumeration reveals an exposed /plugins directory containing a custom Java archive (BlockyCore.jar). Decompiling the file exposes hardcoded MySQL credentials, which are reused to gain SSH access as the user notch. Full root privileges are easily obtained by running sudo -i due to misconfigured sudo rights.

7 January 2026

Bashed

#Information Disclosure #Exposed Web Shell #Sudo Misconfiguration #Cron Job Abuse

Bashed is an easy-difficulty Linux machine on Hack The Box. Web enumeration reveals an exposed ‘phpbash’ web shell inside a hidden /dev/ directory. After establishing an interactive reverse shell, user pivoting to scriptmanager is achieved via misconfigured NOPASSWD sudo privileges. Root access is obtained by exploiting a root cron job that periodically executes editable Python scripts inside the /scripts directory.

6 January 2026

Alert

#Cross Site Scripting #Local File Inclusion #Arbitrary File Read

Alert is an easy-difficulty Linux machine on Hack The Box. Exploitation begins by leveraging a Stored XSS vulnerability in a Markdown viewer to execute JavaScript within the administrator’s session and exfiltrate local files (LFI). This allows retrieving credentials to gain SSH access as the user albert. For privilege escalation, writable permissions on a PHP configuration file executed by a root cron job are abused to set the SUID bit on /bin/bash.

4 January 2026