VulnLab: Baby2

Active Directory machine demonstrating SMB user enumeration, weak password reuse, writable logon script abuse, and GPO-based privilege escalation.

March 22, 2026 · 8 min

VulnLab: Baby

Active Directory machine demonstrating anonymous LDAP enumeration, password reset abuse, SeRestorePrivilege execution, and manual NTDS extraction.

March 21, 2026 · 6 min

HTB: Access

Windows machine demonstrating anonymous FTP exposure, credential recovery from MDB and PST files, Telnet access, and stored credential abuse.

March 7, 2026 · 5 min

HTB: Buff

Windows machine demonstrating unauthenticated file upload leading to CloudMe buffer overflow exploitation and administrator access.

March 5, 2026 · 5 min

HTB: Bashed

Linux machine demonstrating exposed PHP web shell access, sudo-based lateral movement, and cron-driven privilege escalation.

March 3, 2026 · 4 min

HTB: Arctic

Windows machine demonstrating Adobe ColdFusion remote code execution and kernel-based privilege escalation to SYSTEM.

March 2, 2026 · 4 min

HTB: Bounty

Windows machine demonstrating IIS upload bypass with web.config abuse and kernel exploit privilege escalation.

March 1, 2026 · 5 min

HTB: Builder

Linux machine demonstrating Jenkins CLI arbitrary file read, Jenkins user hash extraction, credential cracking, and SSH key abuse for root access.

February 21, 2026 · 5 min

HTB: BoardLight

Linux machine demonstrating vhost discovery, Dolibarr authenticated RCE, credential disclosure, and Enlightenment SUID privilege escalation.

February 18, 2026 · 4 min

HTB: Busqueda

Linux machine demonstrating Python eval command injection, credential reuse, Docker configuration disclosure, and sudo script abuse.

February 15, 2026 · 6 min