Sendai
Sendai is a medium-difficulty AD box: anonymous SMB and RID brute force reveal expired/weak accounts; resetting thomas.powell yields a domain foothold. BloodHound shows abuse paths to the MGTSVC$ GMSA...
HackTheBox - Machines
Comprehensive writeups for HackTheBox machines across Easy, Medium, Hard, and Insane difficulties
Total 169 reports , currently page 2 of 17 (10 per page)
💡 Ctrl + K to quickly focus search box
Hercules
It is a very complex and lengthy AD domain mixed web abnormal level machine, and it can even be said that the utilization path is more abnormal than DarkCorp.
Signed
In general, there are many paths to root on this machine, but for the user part, it is very unstable when verifying mssql. If you always receive the prompt: "Connection refused because the domain name...
Lock
Lock is an easy Windows box: enumerate a Gitea repo to get a Personal Access Token, deploy an ASPX web shell for initial access, decrypt a password from an mRemoteNG config to access another user, the...
Manage
Manage is an easy Linux box: exploit an exposed Java RMI/JMX service for RCE as tomcat, find leaked SSH keys and OTPs from a misconfigured backup to move to useradmin, then abuse a sudo misconfigurati...
Reset
Reset (Easy) gained remote code execution by poisoning logs and abusing the website's password reset function; it then leveraged Rservices and sudo permissions on nano in a separate tmux session to el...
RetroTwo
RetroTwo (Easy, Windows): Downloads a password-protected .accdb from an open SMB, decrypts it, and extracts AD credentials in VBA; leverages a pre-configured computer account with GenericWrite permiss...
VulnEscape
VulnEscape is an Easy Windows machine: Log in via default RDP as KioskUser0 without a password. Edge's file:// bypass allows browsing the file system and opening PowerShell in a restricted environment...
VulnCicada
VulnCicada is a mid-level Windows AD machine: after discovering an image with a hidden password in a public share, it used that password to identify a vulnerability that could be exploited by ESC8, wh...
Data
By exploiting Grafana's CVE-2021-43798 path traversal, the database can be read, hashes that can be cracked by Hashcat can be extracted and converted, and then boris's SSH login can be obtained; this ...
Jump to