Published on: 6/19/2026
restore a deleted user (`mark.davies`) → **BadSuccessor (dMSA)** to steal its hash → abuse `mark.davies`'s share ACL to drop a malicious **VS Code .vsix** → RCE as developer `ryan.brooks` → hybrid BadSuccessor on `svc_deploy` → read **VMBackups** → **volatility3** on a VM memory dump → local Administrator hash → **Pass-the-Hash** to Domain Admin.
Tags: Hack The Box lab writeup
Published on: 5/29/2026
Reactor is an easy-difficulty Linux box (Ubuntu 24.04) that rewards reading docs over brute force. Recon is sparse — the usual top-100 ports look filtered, so widen your scan and pay close attention to every version string you find on the exposed service; the foothold is a recent framework-level pre-auth RCE that sits exactly in that version window. The PoC is publicly available, but the RCE primitive has real limits on output (newlines and quotes will break your payload), and the box's egress is restricted — common 4444/443/80 reverse shells will silently die, so plan a reliable I/O channel before you start spraying commands. Once inside, skip linpeas for a moment and just list listening ports and systemd unit files; the privesc path is written plainly in a unit's User= and ExecStart= lines, where you'll spot a very recognisable Node debug flag bound to loopback. Exploiting it needs a little Chrome DevTools Protocol (hand-rolled WebSocket + Runtime.evaluate); be aware the target script is an ES module, so require is gone and await import() will throw — there's one classic Node trick that gets around this and it's seconds away once you know it. No AD, no Windows, no brute force — just CVE awareness plus a bit of Node.js internals. Enjoy.
Tags: lab Hack The Box writeup
Published on: 5/2/2026
This is an Insane-difficulty machine involving a multi-domain Active Directory environment with a bidirectional forest trust. The attack chain spans 12 steps, crossing domain boundaries multiple times and exploiting ADCS misconfigurations, JEA bypass techniques, gMSA abuse, RBCD delegation, MSSQL privilege escalation, and certificate template manipulation.
Tags: Hack The Box lab writeup
Published on: 4/26/2026
A restaurant ordering and reservation system implemented as a forking TCP server. The binary contains three distinct vulnerabilities that must be chained together: an off-by-one null byte overflow for privilege escalation, a format string vulnerability for information leaking, and a buffer overflow for code execution.
Tags: Hack The Box writeup pwn
Published on: 4/25/2026
Windows Server 2019 Domain Controller, Medium difficulty, Season 7.
Tags: Hack The Box lab writeup
Published on: 4/18/2026
Tags: Hack The Box writeup pwn
Published on: 4/18/2026
We turned our assembly tester off because a big mistake from our new C developer. Do you think there are other mistakes he made ?
Tags: Hack The Box pwn writeup
Published on: 4/12/2026
Silentium is an Easy Linux machine featuring a Flowise AI Agent Builder (v3.0.5) and an internal Gogs Git service (v0.13.3). The attack chain involves: 1. **CVE-2025-58434** - Flowise password reset vulnerability to gain admin access 2. **Custom Function RCE** - Using LangChain's TextLoader within Flowise's VM2 sandbox to read sensitive environment variables 3. **CVE-2025-8110** - Gogs symlink path traversal to write an SSH public key to root's authorized_keys
Tags: Hack The Box lab writeup
Published on: 4/12/2026
As is common in real life pentests, you will start the Garfield box with credentials for the following account j.arbuckle / Th1sD4mnC4t!@1978
Tags: Hack The Box lab writeup
Published on: 10/6/2024
A simple AD machine can be easily solved by familiarizing yourself with AD enumeration and NTLM Hash cracking and application.
Tags: Hack The Box lab writeup