Hack The Box

Windows machine where an unauthenticated file upload sets up a CloudMe buffer overflow, leading to administrator access.

Windows machine recovering Umbraco credentials from a world-readable NFS share, exploiting an authenticated Umbraco RCE for a foothold, and decrypting a TeamViewer 7 password from the registry for SYSTEM.

Windows machine built around an Adobe ColdFusion remote code execution bug, escalated to SYSTEM with a kernel exploit.

Windows box exploiting an IIS upload filter bypass via web.config, capped off with a kernel exploit for privilege escalation.

Windows machine using MSSQL injection to force NTLM authentication, gain WinRM access, and abuse the UniFi Video service for SYSTEM.

Windows machine extracting MSSQL credentials from an Excel macro, capturing and cracking an NTLMv2 hash via xp_dirtree, enabling xp_cmdshell, and decrypting a Group Policy Preferences password for Administrator.

Windows machine chaining PHP session poisoning for code execution, SMB-hosted RFI for a webshell, reused database credentials, and a malicious CHM help file for administrator.

Windows machine using a Jenkins build step for remote code execution, a KeePass database for a Pass-the-Hash credential, and an alternate data stream hiding the root flag.

Windows machine centred on an AChat buffer overflow with custom shellcode, then credential discovery and password reuse for Administrator.

Windows machine recovering PRTG Network Monitor credentials from anonymous FTP-accessible config backups and exploiting CVE-2018-9276 for an immediate SYSTEM shell.