The Backfire machine demonstrates a vulnerability in the Command and Control server Havoc, that allows for SSRF, and with credentials allows RCE as well. It also demonstrates vulnerabilities in the HardHat C2 server to get RCE as Sergej. It then demonstrates a privilege escalation tactic for how to gain root when a user can run iptables as sudo.
10/07/2025
This is a HackTheBox that machine contains a wordpress website that uses an outdated version of PHP that contains an iconv vulnerability. By using a plugin that allows for a file_get_contents call, and pulling information about the system the buffer can be overflowed and directed at the php binary to make a system call. Afterwards internally the user creds can be cracked from the web database, and the root path requires analyzing an Android APK file to learn how to make requests to the internal app that has root privileges and an RCE vulnerability.
10/07/2025
The Cat machine from HackTheBox is a machine that demonstrates multiple web vulnerabilities to allow getting from nothing to owning the machine. It starts with an XSS vulnerability, and then uses an SQL injection. It demonstrates how logs can contain sensitive information, and then another XSS via a Gitea 1.22.0 vulnerability to dump data from another page with the root password.
10/07/2025
This HackTheBox machine has a TeamPass and Bookstack server on it on different ports. Using an SQL injection against the Teampass server results in credentials against SSH for reader and Bookstack for Bob. The SSH has MFA enabled, so inside of Bookstack there is another vuln for local file read via Blind SSRF, which can be used to get the MFA secret for reader. Privilege Escalation is done by overwriting Shared Memory for a program that runs occasionally as root user that is using the Shared Memory to store commands.
10/07/2025
This HackTheBox machine displays a Python Code Editor application that has a Jail Break that is possible. After escaping the sandbox inside of the sqllite database file there is a credential for martin that can be cracked. Martin has access to run a command as sudo, and using this it is possible to escalate or just to copy the root flag in /root.
10/07/2025
This HackTheBox machine is a Windows Active Directory machine that contains a web server with Splunk on it. Leveraging a Splunk Local File Read vulnerability which can dump the splunk.secret file and authentication.conf file, which used together can give a clear password for the paul.taylor user. Using this password for a spray also reveals that it is used for the mark.adams user who has GMSA privileges and allows dumping Service Account passwords. Using this service account another account can be given Shadow Credentials through AD, and then that account with Remote privileges can be used to search the files on the machine and find a backup of the Splunk instance with a password for the admin user on Splunk. Creating a reverse shell on splunk shows that it is being run by someone with the SEImpersonatePrivilege which is an easy privesc.
10/07/2025
This is a HackTheBox machine that contains a CVE against Apache struts 6.3 which allows for bypassing default upload security, that has been secured by checking the magic bytes, and filename of the file being added. Bypassing these security items, with a jsp webshell results in code execution. Enumeration then results in a user password, and an ssh session. After getting user a simple privilege escalation vector is shown via tcpdump.
01/24/2024