Latest writeups
See all posts →
HTB Authority: Medium Walkthrough – Ansible Vault, LDAP Pass-Back, and ADCS ESC1
HTB Administrator: Medium Walkthrough – ACL Abuse Chain to Targeted Kerberoasting and DCSync
A single set of low-privilege AD credentials unlocks a chain of ACL abuses — GenericAll, ForceChangePassword, and GenericWrite — that leads to a targeted Kerberoasting attack and finally a DCSync, dumping the Administrator hash straight out of the domain.
Wiz Day One — Kubernetes Onboarding CTF: 7 Misconfigurations to Full Compromise
A simulated corporate onboarding system running on Kubernetes hides seven flags behind seven distinct misconfigurations — leaked credentials, a DLP filter that leaks its own secrets, a forgeable HMAC token that bypasses a NetworkPolicy, and more.
HTB Voleur: Medium Walkthrough – Kerberos-Only AD, Targeted Kerberoasting & Tombstone Revival to Domain Admin
A Kerberos-only domain controller forces every tool into Kerberos mode. An encrypted spreadsheet leaks service account passwords, a WriteSPN ACL enables targeted Kerberoasting, and AD's rarely-abused deleted-object restore feature resurrects a leaver account whose leftover DPAPI secrets cascade all the way to a WSL root shell holding a full NTDS.dit backup.
StreamIO — SQL Injection to RFI, Firefox Creds, and LAPS Abuse on a Windows DC
MSSQL injection on a movie streaming site leaks password hashes, chained with LFI and a dangerous PHP eval() to land a shell — then Firefox saved passwords and BloodHound ACL abuse lead to reading LAPS and becoming Administrator.
VulnCicada — ADCS ESC8 relay via PetitPotam coercion to Domain Admin
NFS share leaks a user password hidden in an image post-it note; NTLM is disabled forcing Kerberos-only auth; ESC8 web enrollment relay via PetitPotam coercion yields a DC certificate and full domain compromise.
Enigma — NFS credential leak, OpenSTAManager RCE, and OliveTin command injection to root
Unauthenticated NFS share leaks employee credentials → webmail credential reuse → OpenSTAManager RCE via unrestricted file upload → bcrypt hash cracking → OliveTin argument injection as root → SUID bash.
Media — NTLM Hash Capture via Malicious ASX File and SeTcbPrivilege Escalation
A malicious Windows Media Player playlist triggers an outbound SMB connection, leaking an NTLMv2 hash. Once inside, a Windows Junction Point attack redirects file uploads to the web root, delivering a PHP webshell that runs as LOCAL SERVICE with SeTcbPrivilege — enough to become Administrator.
TombWatcher — AD Privilege Chain to ESC15 (CVE-2024-49019) Domain Takeover
A five-hop BloodHound chain — WriteSPN → Kerberoast → gMSA dump → password resets → WinRM — leads to a deleted AD account holding ESC15 (CVE-2024-49019) rights on an ADCS template, ultimately yielding Domain Admin via PassTheCert over Schannel.
Nimbus — SSRF to IMDS Credential Theft, YAML Deserialization RCE, and Privileged Container Escape via core_pattern
An SSRF on a job scheduler leaks AWS IAM credentials from the instance metadata service. The stolen credentials give access to an SQS queue consumed by a worker doing unsafe YAML deserialization — yielding RCE inside a container. From there, a privileged CodeBuild container built with LocalStack is used to overwrite kernel's core_pattern and escape to root on the host.
HTB Pov: ASP.NET ViewState Deserialization and SeDebugPrivilege Abuse
A path traversal on an IIS endpoint leaks the ASP.NET machineKey, enabling ViewState deserialization RCE. Credential extraction from a PSCredential XML file pivots to a user with SeDebugPrivilege, abused to migrate into a SYSTEM process.
Checkpoint — BadSuccessor CVE-2025-29810 + VM Memory Forensics
From a malicious VS Code extension to Domain Admin via a fresh 2025 AD privilege escalation — BadSuccessor (CVE-2025-29810) chained with VM memory forensics.
HTB AirTouch: Medium Walkthrough – SNMP Leak to WPA2-Enterprise Rogue AP Attack
An SNMP system description leaks an SSH password. Network segmentation reveals three VLANs accessed via Wi-Fi. WPA2-PSK cracking provides a foothold in the Tablets VLAN, followed by web exploitation and certificate theft. A rogue access point attack against WPA2-Enterprise captures an MSCHAPv2 hash, which is cracked to gain access to the Corporate VLAN and root.
HTB Cap: IDOR to PCAP Credential Leak and PwnKit Privilege Escalation
An IDOR vulnerability on a network capture endpoint reveals plaintext FTP credentials in a PCAP file. Credential reuse provides SSH access, and a vulnerable pkexec SUID binary (CVE-2021-4034) allows root escalation.
HTB Connected: From Unauthenticated SQLi to Root via FreePBX, incron & Sudoers Hijack
An unauthenticated SQL injection in FreePBX 16.x (CVE-2025-57819) allows credential extraction and hash replacement, leading to admin access. POST_RELOAD shell injection provides RCE as asterisk. A world-writable incron trigger file and writable module directory enable sudoers hijack for root.
HTB DevHub (Medium): CVE-2026-23744 → JupyterLab WebSocket RCE → Hidden MCP Tool to Root
An unauthenticated RCE in MCPJam Inspector (CVE-2026-23744) provides initial access. A JupyterLab token exposed in process arguments enables lateral movement via a raw WebSocket client. Reading the source code of an internal MCP server reveals a hidden tool that dumps root's SSH private key.
HTB Fluffy: From Low-Priv Creds to Domain Admin via CVE-2025-24071 & Shadow Credentials
Starting with low-privileged domain credentials, the attack chain exploits CVE-2025-24071 to leak an NTLM hash, cracks it, abuses GenericAll ACLs, uses Shadow Credentials to take over service accounts, and finally forges an Administrator certificate via ADCS for Domain Admin.
HTB Helix: Apache NiFi RCE (CVE-2023-34468) → OPC UA Logic Manipulation to Root
Subdomain enumeration reveals an unauthenticated Apache NiFi instance. CVE-2023-34468 (H2 JDBC INIT injection) provides a shell as nifi. An SSH key found in NiFi support bundles grants access as operator. Privilege escalation requires manipulating OPC UA industrial control nodes to trigger a safety controller maintenance window, leading to root.
HackTheBox - Jeeves Writeup | Windows Medium
Unauthenticated Jenkins Script Console leads to RCE, a KeePass database is cracked to obtain an NTLM hash, and Pass-the-Hash grants SYSTEM access before extracting the root flag from an NTFS Alternate Data Stream.
HTB Logging: Credential Exposure → Shadow Credentials → DLL Injection → WSUS Poisoning
Starting with a low-privileged user, SMB enumeration reveals hardcoded credentials in a log file. Password pattern inference leads to an updated credential. GenericWrite over a gMSA enables Shadow Credentials and WinRM access. DLL injection via a scheduled task gives lateral movement, and WSUS poisoning combined with ADIDNS spoofing and ADCS certificate abuse yields SYSTEM.
HTB MonitorsFour: IDOR to RCE to Docker Escape
An unauthenticated IDOR on an internal API leaks user credentials. Cracking an MD5 hash grants access to a Cacti instance vulnerable to CVE-2025-24367 (authenticated RCE). From a www-data shell inside a Docker container, an exposed Docker Engine API (port 2375) enables container escape and host compromise.
Postman — Unauthenticated Redis to Webmin RCE
An unauthenticated Redis instance allows SSH key injection for initial access. A backup encrypted private key cracks to reveal credentials for user Matt, then Webmin 1.910 RCE (CVE-2019-12840) delivers a root shell.
HTB Principal: JWT Authentication Bypass to SSH CA Key Forgery
A Java web app using pac4j-jwt/6.0.3 is vulnerable to CVE-2026-29000, allowing JWT authentication bypass via JWE token forgery. API enumeration as admin leaks an SSH deployment key. With user access, a readable SSH CA private key enables forging a root certificate for privilege escalation.
HTB Reactor: CVE-2025-55182 + Node.js Debug RCE
A critical RCE vulnerability in Next.js React Server Components (CVE-2025-55182) provides initial access. A misconfigured Node.js debugger bound to localhost enables privilege escalation to root.
HTB Silentium: Flowise ATO + RCE → Docker Escape → PackageKit LPE (CVE-2026-41651)
Vhost fuzzing reveals a Flowise 3.0.5 staging site. CVE-2025-58434 leaks a password reset token, enabling account takeover. CVE-2025-59528 provides authenticated RCE inside a Docker container. Credential reuse from environment variables leads to SSH access, and CVE-2026-41651 (Pack2TheRoot) grants root.
HTB SmartHire: CVE-2024-37054 (MLflow RCE) → Python Module Hijacking via .pth
An MLflow deserialization vulnerability (CVE-2024-37054) provides initial access. Privilege escalation uses a Python module hijacking via site.addsitedir and malicious .pth files to execute code as root.
HTB Snapped (Hard): CVE-2026-27944, bcrypt, and Two Paths to Root via PackageKit and snap-confine
From an unauthenticated Nginx UI backup disclosure (CVE-2026-27944), a bcrypt hash is cracked to gain user access. Privilege escalation is possible via either CVE-2026-41651 (PackageKit TOCTOU) or the intended race condition in snap-confine (CVE-2026-3888).
HTB Support: SMB Anonymous Access → Binary Reversing → LDAP Credentials → RBCD Privilege Escalation
Anonymous SMB access reveals a .NET binary containing hardcoded XOR-encrypted LDAP credentials. After enumerating LDAP, a cleartext password in the info attribute grants WinRM access. BloodHound shows GenericAll on DC$, enabling RBCD abuse to impersonate Administrator and achieve SYSTEM on the Domain Controller.
Trick — DNS Zone Transfer to Fail2Ban Privilege Escalation
A multi-stage attack chain combining DNS Zone Transfer, SQL Injection, FILE privilege abuse, LFI, SSH key theft, and a Fail2Ban misconfiguration to obtain root access.
HTB TwoMillion: A Lesson in API Abuse and Privilege Escalation
JavaScript deobfuscation reveals hidden API endpoints, leading to invite code generation. API route enumeration exposes an admin section with broken access control, enabling self-promotion to admin. Command injection in a VPN generation endpoint provides a shell. A leaked .env file gives SSH credentials, and CVE-2023-0386 (OverlayFS) escalates to root.
Forest — AS-REP Roasting et DCSync via Exchange permissions
AS-REP Roasting sur un compte sans pré-auth Kerberos, puis abus des permissions Exchange WriteDACL pour obtenir DCSync et dumper les hashes NTDS.
Articles
See all → AWS EC2 Fundamentals — instances, security groups, pricing and networking
EC2 is AWS's flagship IaaS service. Instance types, bootstrap scripts, Security Groups, SSH access, purchasing options, IP addressing, Placement Groups and ENIs — a full rundown of the fundamentals.
AWS IAM & CLI — understanding identities, permissions and best practices
IAM is the AWS service that manages identities and permissions. Users, groups, JSON policies, roles, MFA, and the Credential Report / Last Access audit tools — everything you need to secure an AWS account.
Your brain has 4 types of memory. So does your AI agent. Here's which one to give it.
AI agents have four memory types directly inspired by human cognition: working, semantic, procedural, and episodic. Each agent type only needs the memory that matches its tasks. Learn how to design agent memory for better performance.