Richie Havoc
Security Researcher | Student | Pentester | CTF Player 🎉
Latest Posts
View all →
HTB GhostLink Complete Writeup: MQTT Healthcheck NTLM Relay, Gogs CVE-2025-8110 and ESC11 ADCS Domain Compromise
GhostLink is a HackTheBox Hard Windows machine pairing an Active Directory Domain Controller with two internal application servers hiding behind a reverse proxy. The chain starts with an unauthenticated MQTT broker whose node healthcheck topic can be poisoned to force the svc_canary service account into an NTLM relay, yielding an authenticated session on an internal secure file sharing application. A double URL encoded path traversal there exposes svc_canary's ntuser.dat, whose RecentDocs artifact reconstructs the path to a KeePass database holding Gogs credentials. The internal Gogs 0.13.3 instance falls to CVE-2025-8110 symlink based RCE for a shell as git on the toolkits host, and the exfiltrated gogs.db hands over a PBKDF2 hash that cracks in under a minute against a password-policy trimmed wordlist, becoming nvirelli and user.txt. Reaching root.txt requires pivoting a chisel SOCKS tunnel into the internal 172.16.20.0/24 network, then abusing ESC11: coercing the DC01$ machine account and relaying it to the certificate authority's unencrypted ICPR RPC interface to mint a DomainController certificate, finishing with a DCSync and a pass-the-hash WinRM session as Administrator.
HTB DanglingTree Complete Writeup: CVE-2026-23760 (SmarterMail Sysadmin Reset), CVE-2026-26119 (Windows Admin Center), DPAPI Credential Manager Dump and ESC1 Dangling Certificate Template Domain Admin
DanglingTree is a HackTheBox Season 11 Hard Windows machine built around one idea, the dangling reference. Enumeration of an anonymous SMB share leaks a low privilege domain credential that unlocks the Windows Admin Center gateway on port 6600, where an RSA OAEP encrypted login yields PowerShell code execution on the Domain Controller. From that foothold an unauthenticated SmarterMail sysadmin password reset (CVE-2026-23760, build 9504 before 9511) is fired at the loopback only mail service through a raw socket, and the resulting PrimarySysAdmin token is abused through the volume mount feature to execute commands as the svc_mail service account. A backup SmarterMail settings.json still holds an encrypted password for noah.b, which is recovered by extracting a hardcoded DES key and IV from SmarterMail.Standard.dll with offline dnfile parsing. Running as noah.b via RunasCs grants user.txt, and a saved cmdkey credential for alex.o is recovered by offline DPAPI decryption of the masterkey using the protected storage derivation. alex.o holds ForceChangePassword over jake.h, and jake.h holds CreateChild over the Certificate Templates and OID containers, which is enough to recreate one of three published but deleted certificate templates as a malicious ESC1 template, request an Administrator certificate with the correct object SID, recover the NTLM hash through PKINIT UnPAC the hash, and pass the hash with smbexec to read root.txt.
East Africa Intervarsity CTF 2026 Qualifiers Writeup: Crypto, RE, Web & Forensics Full Walkthrough
Complete, technical writeups for every challenge solved in the East Africa Intervarsity CTF 2026 Qualification Round, a Jeopardy-style qualifier for the East Africa Intervarsity CTF 2026 Finals. Covers ten challenges spanning cryptography, reverse engineering, web exploitation, and digital forensics: 'The Uhuru Torch' (recovering a synthetic PNG's pixel-generator formula to extract two hidden LSB stego channels, chained through AES-256-CBC, zlib inflate, and ROT47 decoding); 'Blind Spot' (breaking a textbook RSA blind-signature scheme by inverting a leaked unmask_token to forge a valid signature and recover a restricted document hash with zero access to the private key); 'Clockwork' (reverse engineering a stripped x86-64 ELF running a hand-rolled, XOR-obfuscated bytecode VM, then inverting a two-pass add/xor/rotate/multiply and sbox/add/rotate cipher in linear time); 'Trusted Courier' (exploiting a SHA-256 keyed-prefix MAC with a from-scratch Python hash length-extension attack and secret-key-length brute force to forge an authorized manifest); 'Ghost Writer' (a statically-linked, stripped Linux binary whose entire control-flow graph lives inside SIGILL/SIGTRAP/SIGFPE/SIGSEGV signal handlers that rewrite ucontext_t RIP mid-fault, requiring inversion of 48 chained rounds of bijective byte transforms with an FNV-1a tamper-detection chain); 'Glitch in the Vault' (a Bellcore/BDL RSA-CRT fault attack recovering a 1024-bit prime factor from one faulty and one correct signature over the same message, then decrypting an RSA-encrypted compliance report); 'Open Door' (a classic Insecure Direct Object Reference / broken object-level authorization vulnerability in a Flask REST API exposing an admin profile by sequential user ID); 'Trinity' (Hastad's broadcast attack against RSA with e=3 and no padding, using Chinese Remainder Theorem combination and an exact integer cube root to recover a firmware image encrypted under three different moduli); 'UnderStudy' (a six-file Windows EVTX digital forensics and incident response case involving Kerberoasting via RC4-encrypted service tickets, DCSync replication rights abuse, Security log clearing, and Sysmon-based timeline reconstruction after re-keying on originating-host EventTime instead of forwarder collection time); and 'Vault Keeper' (hand-disassembling a stripped .NET/CLR console binary directly from raw PE metadata tables and IL bytecode without ILSpy or dnSpy, then defeating an anti-debugging Probe() trap and collapsing a 95^16 brute-force search space into four independent 95^4 block searches using inlined single-block SHA-256). Each section includes full exploit scripts in Python and C, binary/protocol analysis, root-cause explanations, and defensive mitigations.
HTB Cohort Complete Writeup (CVE-2026-39987, CVE-2026-41651): SSRF Vhost Discovery, Marimo Pre-Auth WebSocket RCE and PackageKit Pack2TheRoot Root Escalation
Cohort is a HackTheBox Season 11 Linux machine built around a public marketing portal that quietly proxies an internal analyst workspace. The chain starts with an SSRF in the portal's source URL feature, where loopback style addresses are blocked by name but not by every equivalent representation, letting an attacker reach an internal nginx status endpoint. That endpoint discloses the upstream map, including a randomized internal vhost that fronts a Marimo notebook service bound to loopback on the box. Once the vhost is resolved locally and reached through the reverse proxy, Marimo's unauthenticated terminal WebSocket endpoint is abused through CVE-2026-39987 to get command execution as the marimo user and capture user.txt. Escalation to root abuses CVE-2026-41651, known as Pack2TheRoot, a time of check to time of use race condition in PackageKit's D-Bus transaction handling that lets an unprivileged user swap a simulated package install for a malicious one and land a SUID root shell.
HTB DarkZero Returns Complete Writeup: CVE-2026-33937 (Handlebars AST Injection), Gitea Actions Abuse and Cross Forest Trust Root Escalation
DarkZero Returns is a HackTheBox Season 11 Hard machine built around a two forest Active Directory environment fronted by a single Linux edge host. The chain starts with an unauthenticated Handlebars AST injection in the campaign_message field of a D&D style web app, granting a reverse shell on SRV01. From there, exposed SSH credentials for the domain user josh lead into a Gitea instance reachable through Kerberos SSPI, where a malicious Actions workflow injected via a fork and pull request executes as svc-runner and discloses user.txt. Reaching root.txt requires pivoting a SOCKS tunnel into the internal 172.16.20.0/24 network, then chaining a delegated Active Directory OU right into local root on SRV01, cracking a Domain Admin NTLM hash recovered from a database backup, and forging a golden ticket with a cross forest extra SID to abuse loose SID filtering and land Backup Operators rights on the second forest's Domain Controller.
HTB MakeSense Complete Writeup - Client-Side Crypto, Stored XSS & Root PHP Dev Server
MakeSense is a HackTheBox Season 11 Medium Linux machine centered around a WordPress site with a custom 'webagency' theme. The exploitation chain begins with enumerating a client-side voice/contact feature that encrypts data using a hardcoded JavaScript key before sending to WordPress via admin-ajax.php. An attacker can forge encrypted payloads using the exposed key, first creating a contact submission and then attaching a forged encrypted 'summary' containing a stored XSS payload. When the admin bot opens the submission in /wp-admin, the XSS executes and creates a new administrator account (svc_wp). Logging in as svc_wp allows uploading a malicious plugin ZIP for PHP code execution as www-data. The wp-config.php file leaks SSH credentials for user walter, granting a shell and user.txt. Privilege escalation comes from a root-owned PHP development server bound to 127.0.0.1:8001 running an OCR web app that saves recognized text to arbitrary filenames in its web root. By saving a PHP webshell as shell.php, full root command execution is achieved and root.txt is captured.