Hack The Box

Linux box where an unauthenticated XWiki RCE gives a foothold, database credentials are reused over SSH, and a Netdata ndsudo PATH vulnerability leads to root.

Linux machine chaining an exposed .git repository, a cPickle insecure deserialization RCE recovered from commit history, a CouchDB privilege-escalation CVE, and sudo pip abuse to root.

Linux Docker machine chaining a REST API JWT secret leaked in Git history, a Python eval() command injection, database credential recovery, and a HashiCorp Vault SSH OTP privilege escalation to root.

Linux target combining an unauthenticated Langflow RCE, JWT algorithm confusion, a malicious MCP tool registration, and a Kubernetes nodes/proxy escalation to host root.

Windows box recovering Cisco device passwords, RID brute forcing usernames, password spraying, and pulling credentials from Firefox process memory.

Linux box exploiting an unfinished LimeSurvey install via malicious plugin upload, then Docker credential exposure and SUID abuse through a shared volume.

Windows box abusing a path-traversal bug in hMailServer for credentials, capturing NTLM via a crafted email, and executing code through LibreOffice.

Windows machine where anonymous FTP exposure leads to credential recovery from MDB and PST backups, Telnet access, and stored-credential abuse via runas /savecred.

Windows machine using TLS certificate enumeration to find a staging subdomain, SSRF to leak admin credentials, a PHP webshell upload for a foothold, and an AlwaysInstallElevated MSI for SYSTEM.

Windows machine exploiting an unprotected change-password endpoint via CSRF to hijack an account, planting a PHP webshell through an SMB-writable IIS site, and recovering Administrator credentials from a WSL bash history file.