Published on: 5/29/2026
Reactor is an easy-difficulty Linux box (Ubuntu 24.04) that rewards reading docs over brute force. Recon is sparse — the usual top-100 ports look filtered, so widen your scan and pay close attention to every version string you find on the exposed service; the foothold is a recent framework-level pre-auth RCE that sits exactly in that version window. The PoC is publicly available, but the RCE primitive has real limits on output (newlines and quotes will break your payload), and the box's egress is restricted — common 4444/443/80 reverse shells will silently die, so plan a reliable I/O channel before you start spraying commands. Once inside, skip linpeas for a moment and just list listening ports and systemd unit files; the privesc path is written plainly in a unit's User= and ExecStart= lines, where you'll spot a very recognisable Node debug flag bound to loopback. Exploiting it needs a little Chrome DevTools Protocol (hand-rolled WebSocket + Runtime.evaluate); be aware the target script is an ES module, so require is gone and await import() will throw — there's one classic Node trick that gets around this and it's seconds away once you know it. No AD, no Windows, no brute force — just CVE awareness plus a bit of Node.js internals. Enjoy.
Tags: lab Hack The Box writeup
Published on: 5/2/2026
This is an Insane-difficulty machine involving a multi-domain Active Directory environment with a bidirectional forest trust. The attack chain spans 12 steps, crossing domain boundaries multiple times and exploiting ADCS misconfigurations, JEA bypass techniques, gMSA abuse, RBCD delegation, MSSQL privilege escalation, and certificate template manipulation.
Tags: Hack The Box lab writeup