Write-ups

Altered | HackTheBox

A hard-difficulty Linux box centered on a Laravel password-reset flow brute-forced past rate limiting with spoofed IP headers, then a type-juggling bypass that unlocks SQL …

WIP - Fulcrum | HackTheBox - WIP

Reset | HackTheBox

An easy-difficulty Linux box chaining an insecure password reset into admin access, an LFI that becomes RCE through Apache log poisoning, lateral movement by abusing BSD r-services …

Validation | HackTheBox

An easy-difficulty Linux box centered on a blind SQL injection in a registration form's country parameter, chained through sqlmap's FILE privilege abuse into a PHP webshell and …

DarkZero | HackTheBox

A hard-difficulty Windows AD box built around a cross-forest MSSQL trusted link, SeServiceLogonRight abuse to recover SeImpersonatePrivilege, and unconstrained TGT delegation …

Remote | HackTheBox

An easy Windows box running Umbraco CMS. Creds leak from a world-readable NFS share, an authenticated Umbraco exploit gets a foothold, and a Print Spooler abuse gets SYSTEM.

GroundWorm | HackTheBox

A walkthrough of GroundWorm, a hard-rated DFIR Sherlock on HackTheBox, tracing a simulated APT attack from initial access through ransomware deployment using Splunk and API …