All Articles & Walkthroughs

Management is an Easy difficulty HackTheBox machine that hosts a vulnerable web application allowing unauthenticated Remote Code Execution through a deserialization flaw. Initial foothold yields a low-privileged shell, leading to internal database enumeration where an encrypted service password is extracted. Decrypting this secret using a locally discovered key file provides SSH access as the target user. Root access is then achieved by exploiting parameter handling in a restricted backup utility command running with elevated privileges to read arbitrary system files.

Devvortex is an Easy difficulty HackTheBox machine that hosts a vulnerable Joomla application. Initial foothold involves exploiting an unauthenticated JoomlaAPI information disclosure vulnerability (CVE-2023-23752) to leak database credentials, gaining administrative dashboard access to edit a template file and execute a reverse shell as www-data. Lateral movement is achieved by dumping and cracking the password hash for user logan from the MySQL database to log in via SSH. Privilege escalation to root is accomplished by triggering a terminal pager breakout through a sudo apport-cli crash report inspection (CVE-2023-1326).

Sau is an Easy difficulty HackTheBox machine that hosts a vulnerable version of the Request Baskets application on port 55555. Initial foothold involves exploiting a Server-Side Request Forgery (SSRF) vulnerability (CVE-2023-27163) to reach an internal Maltrail service running on port 80. Leveraging an OS command injection flaw in Maltrail yields initial shell access as the puma user. Privilege escalation is achieved by executing a privileged service and using a terminal pager breakout (!sh) through less to drop directly into a root shell.

Jerry is a HackTheBox Easy difficulty machine that hosts an Apache Tomcat/7.0.88 application. The initial access involves using leaked credentials from a 403 error page on /host-manager/html to log in to the Tomcat Web Application Manager at /manager/html. Once authenticated, uploading and deploying a custom WAR archive grants an immediate reverse shell with NT AUTHORITY\SYSTEM privileges, bypassing the need for further privilege escalation and providing full administrative access to both flags simultaneously.

Silentium is a HackTheBox Easy difficulty machine that hosts a Flowise AI staging site that is vulnerable to multiple exploits. Initial foothold involves exploiting CVE-2025-58434 to bypass authentication on a user account, followed by leveraging CVE-2025-59528 for remote code execution to gain a container root shell. After extracting hardcoded SMTP credentials to SSH into the host as the user, privilege escalation to root is achieved by exploiting a PackageKit TOCTOU race condition (CVE-2026-41651).

Cronos is a HackTheBox Medium difficulty machine that hosts an admin panel that is vulnerable to SQL Injection. Initial foothold involves submitting a crafted payload that bypasses authentication, leading to command injection via the web ping utility to spawn a shell as www-data. Privilege escalation is achieved by locating a root cron job that runs Laravel's artisan script. Because www-data has write permissions to this file, injecting a reverse shell command into the script grants full root access.

Orion is a HackTheBox easy machine that hosts a vulnerable Craft CMS version. Foothold is gained using the Craft CMS Pre-Auth RCE (CVE-2025-32432). Lateral movement includes harvesting credentials from a MySQL database and cracking them using Hashcat. Lastly, privilege escalation is achieved by exploiting the Telnet authentication bypass (CVE-2026-24061) vulnerability.

Ironbark Urban Products is the pseudonym used for a small-to-medium-sized Australian business operating in the manufacturing and supply sector. The security review uncovered several dangerous weaknesses that had accumulated over time. The system looked healthy from the outside, while security risks had accumulated underneath.

Grandpa is an easy HackTheBox machine that is running a vulnerable Microsoft IIS 6.0 server. Initial access includes exploiting WebDAV Buffer Overflow(CVE-2017-7269), and privilege escalation includes exploiting a kernel vulnerability(MS14-070).