Signed
In general, there are many paths to root on this machine, but for the user part, it is very unstable when verifying mssql. If you always receive the prompt: "Connection refused because the domain name...
HackTheBox - Machines
Comprehensive writeups for HackTheBox machines across Easy, Medium, Hard, and Insane difficulties
Total 187 reports , currently page 4 of 19 (10 per page)
💡 Ctrl + K to quickly focus search box
Lock
Lock is an easy Windows box: enumerate a Gitea repo to get a Personal Access Token, deploy an ASPX web shell for initial access, decrypt a password from an mRemoteNG config to access another user, the...
Manage
Manage is an easy Linux box: exploit an exposed Java RMI/JMX service for RCE as tomcat, find leaked SSH keys and OTPs from a misconfigured backup to move to useradmin, then abuse a sudo misconfigurati...
Reset
Reset (Easy) gained remote code execution by poisoning logs and abusing the website's password reset function; it then leveraged Rservices and sudo permissions on nano in a separate tmux session to el...
RetroTwo
RetroTwo (Easy, Windows): Downloads a password-protected .accdb from an open SMB, decrypts it, and extracts AD credentials in VBA; leverages a pre-configured computer account with GenericWrite permiss...
VulnEscape
VulnEscape is an Easy Windows machine: Log in via default RDP as KioskUser0 without a password. Edge's file:// bypass allows browsing the file system and opening PowerShell in a restricted environment...
VulnCicada
VulnCicada is a mid-level Windows AD machine: after discovering an image with a hidden password in a public share, it used that password to identify a vulnerability that could be exploited by ESC8, wh...
Data
By exploiting Grafana's CVE-2021-43798 path traversal, the database can be read, hashes that can be cracked by Hashcat can be extracted and converted, and then boris's SSH login can be obtained; this ...
Retro
"Retro" is an Easy Windows machine that exposes an Active Directory Domain Controller. Access to the system was gained through SMB enumeration and exploitation of a pre-created machine account. This w...
DarkZero
The overall challenge on this machine wasn't too great, but the main frustration was escalating privileges on the DC02 machine. I'm not sure if this is due to MSF issues or the machine itself. When us...
Jump to