Hack The Box

Windows machine using anonymous FTP notes and an NVMS-1000 directory traversal to recover credentials, then abusing the NSClient++ REST API for a SYSTEM shell.

Linux box abusing the Jenkins CLI for arbitrary file read, cracking the recovered user hash, and reusing an SSH key for root.

Linux box that starts from an exposed Git repository, gains authenticated RCE in Backdrop CMS, and escalates through password reuse and sudo abuse of the bee CLI.

Linux machine using SSRF to reach an internal API, recovering credentials from Git history, and escalating via a GitPython command injection.

Linux machine chaining a GraphQL credential leak with authenticated blind SQL injection in HelpDeskZ, password/email brute forcing, and a GLIBC-matched kernel exploit for root.

Linux machine bypassing a SQL injection login, forging magic bytes to upload a PHP webshell, and hijacking a SUID binary’s relative-path lshw call for root.

Linux machine where vhost discovery uncovers an authenticated Dolibarr RCE, followed by credential disclosure and Enlightenment SUID privilege escalation.

Linux machine leaking credentials over SNMP, exploiting a Nagios XI SQL injection and legacy admin-creation API, then abusing a sudo script’s unsanitised symlink target for root.

Linux machine driven by a Python eval() command injection, followed by credential reuse, Docker configuration disclosure, and sudo script abuse.

Linux machine exploiting a pdfkit command injection (CVE-2022-25765) for a foothold, then a Ruby YAML deserialization bug in a sudo-permitted script for root.