All Articles & Walkthroughs

Certified is a medium-difficulty HackTheBox machine that begins with low-privileged credentials for an Active Directory domain controller. Leveraging WriteOwner permissions over the MANAGEMENT domain group, ownership is taken, and the DACL is modified to grant full control. Shadow Credentials injection against management_svc yields a Kerberos TGT and NTLM hash for initial WinRM access. Lateral movement to ca_operator is achieved via GenericAll rights using a second Shadow Credentials attack. AD CS enumeration reveals an ESC9 vulnerability on the CertifiedAuthentication certificate template. By temporarily updating ca_operator's userPrincipalName to Administrator, requesting a certificate lacking an object SID extension, and reverting the UPN, PKINIT authentication successfully yields a TGT and recovers the Domain Administrator NTLM hash for full domain compromise.

Layover is an Easy difficulty HackTheBox machine that is part of Season 12.

TwoMillion is an easy-difficulty HackTheBox machine that begins with reverse engineering an obfuscated JavaScript invite code generator to register an account. Mapping API endpoints allows escalating privileges to an administrator via an insecure settings update route and achieving remote code execution through command injection in an OpenVPN configuration generator. Inspecting local configuration files yields database credentials that permit SSH access as the admin user. Privilege escalation to root is accomplished by exploiting an OverlayFS SUID privilege-smuggling vulnerability (CVE-2023-0386) in the Linux kernel to execute an arbitrary payload with elevated rights.

Cicada is an easy-difficulty HackTheBox machine that hosts a Windows Active Directory Domain Controller where initial access begins with unauthenticated SMB share enumeration to retrieve a corporate notice containing a default password. Performing RID brute-forcing identifies domain user accounts, and password spraying yields access as michael.wrightson. Querying Active Directory user attributes reveals plaintext credentials for david.orelious stored inside an account description. Authenticating as david.orelious provides read access to a development SMB share containing a PowerShell backup script, which discloses hardcoded WinRM credentials for emily.oscars. With an interactive WinRM session established as emily.oscars, inspecting user privileges confirms SeBackupPrivilege rights and membership in BUILTIN\Backup Operators. Full domain compromise is achieved by leveraging diskshadow to create a Volume Shadow Copy, extracting ntds.dit and the SYSTEM registry hive to decrypt the Domain Administrator NTLM hash offline, and authenticating via Pass-the-Hash.

Layover is a Medium difficulty HackTheBox machine that is part of Season 12.

BoardLight is an Easy difficulty HackTheBox machine that exposes a CRM application discovered through virtual host enumeration. Authenticating with default credentials allows exploitation of an authenticated remote code execution vulnerability in the application to obtain an initial web shell as www-data. Inspecting the application's database configuration file uncovers plaintext credentials, which are reused via SSH to pivot to user larissa. Privilege escalation to root is achieved by exploiting an SUID binary associated with the window manager due to improper parameter handling.

BrightByte Technologies is the pseudonym used for a small-to-medium-sized Australian business operating an e-commerce website to sell products and services. The security review uncovered some significant findings and observations that might be overlooked by a developer.

Precious is an Easy difficulty HackTheBox machine that features a web service designed to convert web pages into PDF files. Initial access is gained by exploiting a command injection vulnerability in the underlying pdfkit utility to obtain a low-privileged shell as user ruby. Lateral movement to user henry is accomplished by retrieving plaintext credentials stored in a local Bundler configuration file. Privilege escalation to root is achieved by abusing a sudo script that insecurely parses a local dependencies.yml file using Ruby's unsafe YAML.load method, enabling execution of a deserialization gadget chain to spawn an administrative shell.

Writeup is an easy-difficulty HackTheBox machine that hosts a vulnerable CMS Made Simple installation in a hidden directory. Initial access is gained by leveraging an unauthenticated SQL injection vulnerability (CVE-2019-9053) to dump salt and password hashes, which are then cracked to obtain SSH access. Local enumeration reveals that the user possesses write privileges to /usr/local/sbin through membership in the staff group. Privilege escalation to root is accomplished via PATH hijacking: placing a malicious executable named run-parts into /usr/local/sbin triggers arbitrary code execution as root whenever an SSH connection invokes the system's dynamic MOTD update scripts.