Published on: 6/19/2026
restore a deleted user (`mark.davies`) → **BadSuccessor (dMSA)** to steal its hash → abuse `mark.davies`'s share ACL to drop a malicious **VS Code .vsix** → RCE as developer `ryan.brooks` → hybrid BadSuccessor on `svc_deploy` → read **VMBackups** → **volatility3** on a VM memory dump → local Administrator hash → **Pass-the-Hash** to Domain Admin.
Tags: Hack The Box lab writeup
Published on: 5/29/2026
Reactor is an easy-difficulty Linux box (Ubuntu 24.04) that rewards reading docs over brute force. Recon is sparse — the usual top-100 ports look filtered, so widen your scan and pay close attention to every version string you find on the exposed service; the foothold is a recent framework-level pre-auth RCE that sits exactly in that version window. The PoC is publicly available, but the RCE primitive has real limits on output (newlines and quotes will break your payload), and the box's egress is restricted — common 4444/443/80 reverse shells will silently die, so plan a reliable I/O channel before you start spraying commands. Once inside, skip linpeas for a moment and just list listening ports and systemd unit files; the privesc path is written plainly in a unit's User= and ExecStart= lines, where you'll spot a very recognisable Node debug flag bound to loopback. Exploiting it needs a little Chrome DevTools Protocol (hand-rolled WebSocket + Runtime.evaluate); be aware the target script is an ES module, so require is gone and await import() will throw — there's one classic Node trick that gets around this and it's seconds away once you know it. No AD, no Windows, no brute force — just CVE awareness plus a bit of Node.js internals. Enjoy.
Tags: lab Hack The Box writeup
Published on: 5/2/2026
This is an Insane-difficulty machine involving a multi-domain Active Directory environment with a bidirectional forest trust. The attack chain spans 12 steps, crossing domain boundaries multiple times and exploiting ADCS misconfigurations, JEA bypass techniques, gMSA abuse, RBCD delegation, MSSQL privilege escalation, and certificate template manipulation.
Tags: Hack The Box lab writeup
Published on: 4/25/2026
Windows Server 2019 Domain Controller, Medium difficulty, Season 7.
Tags: Hack The Box lab writeup
Published on: 4/12/2026
Silentium is an Easy Linux machine featuring a Flowise AI Agent Builder (v3.0.5) and an internal Gogs Git service (v0.13.3). The attack chain involves: 1. **CVE-2025-58434** - Flowise password reset vulnerability to gain admin access 2. **Custom Function RCE** - Using LangChain's TextLoader within Flowise's VM2 sandbox to read sensitive environment variables 3. **CVE-2025-8110** - Gogs symlink path traversal to write an SSH public key to root's authorized_keys
Tags: Hack The Box lab writeup
Published on: 4/12/2026
As is common in real life pentests, you will start the Garfield box with credentials for the following account j.arbuckle / Th1sD4mnC4t!@1978
Tags: Hack The Box lab writeup
Published on: 10/6/2024
A simple AD machine can be easily solved by familiarizing yourself with AD enumeration and NTLM Hash cracking and application.
Tags: Hack The Box lab writeup
Published on: 9/15/2024
The official rating for this question is Hard, but I don't think the overall difficulty of this question is Hard! The designer of the question may think that the last step of root privilege requires reading the source code before constructing the exploit and payload, but since the project is too small, there is no need to study the source code in-depth. You can quickly find the problematic areas. I think the difficulty level of this problem is Simple to Medium, and the skills required to solve it are not too complicated, so it's still worth practicing.
Tags: Hack The Box lab writeup
Published on: 9/14/2024
This post is a writeup of the Hack The Box Machine Sightless. Although the difficulty level of this machine is judged to be simple, the content covers a variety of different basic penetration testing techniques, including virtual host enumeration, CVE vulnerability exploitation, password cracking and SSH Tunnel, etc. Those who are familiar with penetration testing should be able to get the user flag easily. The difficulty lies in the final escalation to root, which requires a little bit of thinking out of the penetration test. All in all, Sightless is an informative machine, worth playing.
Tags: Hack The Box lab writeup