All Articles & Walkthroughs

DutyBound is a Medium difficulty HackTheBox machine that is part of Season 12.

Silo is a Windows machine that begins by enumerating an exposed Oracle TNS Listener on port 1521. SID brute-forcing identifies the active XE database instance, allowing odat passwordguesser to recover valid database credentials. Leveraging Oracle's UTL_FILE package with --sysdba privileges permits uploading a custom 64-bit ASPX Meterpreter payload directly into the IIS web root. Executing the web shell yields an initial reverse shell under the service context iis apppool\defaultapppool. Because IIS service accounts possess SeImpersonatePrivilege by default, executing Metasploit's getsystem forces spoolsv.exe to authenticate to a rogue pipe, enabling token capture and immediate elevation to NT AUTHORITY\SYSTEM to retrieve the root flag.

Remote is an easy-difficulty HackTheBox Windows machine that begins with enumerating an unauthenticated NFS share to exfiltrate web application backup files. Extracting the SQL Server Compact database file exposes a SHA1 hash for [email protected], which is cracked offline to recover the password. Authenticating to the Umbraco CMS portal allows exploiting an XSLT Remote Code Execution vulnerability (CVE-2019-25137) to execute a PowerShell download cradle and establish an initial reverse shell. Local enumeration reveals an installation of legacy TeamViewer 7, which stores encrypted credentials in the Windows Registry using a globally known AES key. Decrypting these registry keys yields the unattended password, enabling WinRM authentication as administrator to achieve full host compromise and capture the root flag.

BountyHunter is an easy-difficulty HackTheBox Linux machine that begins with web enumeration on an Apache web server running a bug reporting portal. Submitting bug reports transmits Base64-encoded XML payloads to a backend parser vulnerable to XML External Entity (XXE) injection. Leveraging the PHP stream wrapper exfiltrates the source code of db.php, recovering a cleartext password. Password reuse allows securing an SSH initial access shell as the development user. Sudo privileges permit development to execute a custom Python validation script as root. Static analysis reveals unsafe evaluation of ticket code input via eval(), which is exploited by injecting a Python system command payload into a custom ticket file to spawn an interactive root shell and capture the root flag.

Timelapse is an easy-difficulty HackTheBox machine centred on SSL/TLS certificate extraction, PowerShell history enumeration, and Active Directory LAPS misconfigurations on a Windows Domain Controller. Initial reconnaissance reveals unauthenticated guest access to the Shares SMB share, allowing exfiltration of a password-protected backup archive. Cracking the ZIP archive password and subsequent PFX container passphrase yields a client SSL certificate and private key, granting initial WinRM access. Inspecting the PowerShell PSReadLine history file exposes cleartext credentials for svc_deploy, enabling lateral movement. Because svc_deploy belongs to the LAPS_Readers domain group, querying the confidential Active Directory attribute ms-Mcs-AdmPwd via Get-ADComputer extracts the cleartext password for the local Administrator account, leading to full host compromise and root flag retrieval.

Support is a medium-difficulty HackTheBox machine that begins with unauthenticated SMB share enumeration against a Windows Server 2022 Domain Controller. Guest access to the support-tools share yields a custom .NET executable, which is decompiled to reverse a dual-XOR decryption routine and extract credentials for support\ldap. Querying Active Directory user attributes via ldapsearch reveals the cleartext password for the support user stored inside its info field, securing initial WinRM access. Because support belongs to Shared Support Accounts with GenericAll rights over the domain controller computer object, a fake computer account is created via SAMR to configure Resource-Based Constrained Delegation (RBCD). Finally, S4U Kerberos delegation extensions are executed to impersonate the Domain Administrator for CIFS/dc.support.htb, granting full administrative file access over SMB to retrieve the root flag.

Administrator is a medium-difficulty HackTheBox machine that begins with low-privileged credentials for Olivia on an Active Directory domain controller. Leveraging GenericAll permissions over michael, an RPC password reset is executed to gain host access, followed by abusing michael's ForceChangePassword rights to reset benjamin's password. Authenticating as benjamin via FTP allows exfiltrating an encrypted Password Safe database (Backup.psafe3), which is cracked offline to extract credentials for emily and establish initial WinRM access to capture the user flag. Emily's GenericWrite rights over ethan are then exploited via Targeted Kerberoasting to recover ethan's cleartext password. Finally, because ethan holds GetChanges and GetChangesAll replication privileges on the domain object, a DCSync attack is executed to dump the Domain Administrator NTLM hash and achieve full domain compromise.

Certified is a medium-difficulty HackTheBox machine that begins with low-privileged credentials for an Active Directory domain controller. Leveraging WriteOwner permissions over the MANAGEMENT domain group, ownership is taken, and the DACL is modified to grant full control. Shadow Credentials injection against management_svc yields a Kerberos TGT and NTLM hash for initial WinRM access. Lateral movement to ca_operator is achieved via GenericAll rights using a second Shadow Credentials attack. AD CS enumeration reveals an ESC9 vulnerability on the CertifiedAuthentication certificate template. By temporarily updating ca_operator's userPrincipalName to Administrator, requesting a certificate lacking an object SID extension, and reverting the UPN, PKINIT authentication successfully yields a TGT and recovers the Domain Administrator NTLM hash for full domain compromise.

Layover is an Easy difficulty HackTheBox machine that is part of Season 12.