Sau is an Easy difficulty HackTheBox machine that hosts a vulnerable version of the Request Baskets application on port 55555. Initial foothold involves exploiting a Server-Side Request Forgery (SSRF) vulnerability (CVE-2023-27163) to reach an internal Maltrail service running on port 80. Leveraging an OS command injection flaw in Maltrail yields initial shell access as the puma user. Privilege escalation is achieved by executing a privileged service and using a terminal pager breakout (!sh) through less to drop directly into a root shell.

Jerry is a HackTheBox Easy difficulty machine that hosts an Apache Tomcat/7.0.88 application. The initial access involves using leaked credentials from a 403 error page on /host-manager/html to log in to the Tomcat Web Application Manager at /manager/html. Once authenticated, uploading and deploying a custom WAR archive grants an immediate reverse shell with NT AUTHORITY\SYSTEM privileges, bypassing the need for further privilege escalation and providing full administrative access to both flags simultaneously.

Silentium is a HackTheBox Easy difficulty machine that hosts a Flowise AI staging site that is vulnerable to multiple exploits. Initial foothold involves exploiting CVE-2025-58434 to bypass authentication on a user account, followed by leveraging CVE-2025-59528 for remote code execution to gain a container root shell. After extracting hardcoded SMTP credentials to SSH into the host as the user, privilege escalation to root is achieved by exploiting a PackageKit TOCTOU race condition (CVE-2026-41651).