HackTheBox Writeups

HTB BlockSynergy Complete Writeup - Blockchain PoW Mining, SSRF 0.0.0.0 Bypass, URL Userinfo Command Injection, Smart Contract Path Traversal and TOCTOU SUID Race to Root

BlockSynergy is a HackTheBox Insane Linux machine running a blockchain themed Flask application on Werkzeug. The attack chain starts with a public mining API whose proof of work scheme (SHA-256 with a 00000 difficulty prefix) can be reimplemented offline to earn coins, unlocking VIP node registration. The VIP node tester fetches registered URLs server side, and the internal address filter can be bypassed with 0.0.0.0, exposing a localhost only admin panel. The admin ping handler passes URL userinfo data to a shell, so http://x;COMMAND;@0.0.0.0:8080/ yields RCE as walter, with commands hex encoded to survive the URL parser. Privilege escalation to hank abuses a path traversal in a debug smart contract logging engine on 127.0.0.1:5000, appending an SSH public key to authorized_keys. As hank (member of developers), a process watcher captures hardcoded FTP credentials from a root backup cron job. The final escalation is a TOCTOU race against a root restore daemon that downloads a backup archive, verifies its SHA-256, and extracts it with tar as root into /: an inotify watcher atomically swaps a SUID root bash archive into place between verification and extraction, and /opt/blocksynergy/.diag -p drops a root shell for the root flag.

29 min

Hard

HTB GhostLink Complete Writeup: MQTT Healthcheck NTLM Relay, Gogs CVE-2025-8110 and ESC11 ADCS Domain Compromise

GhostLink is a HackTheBox Hard Windows machine pairing an Active Directory Domain Controller with two internal application servers hiding behind a reverse proxy. The chain starts with an unauthenticated MQTT broker whose node healthcheck topic can be poisoned to force the svc_canary service account into an NTLM relay, yielding an authenticated session on an internal secure file sharing application. A double URL encoded path traversal there exposes svc_canary's ntuser.dat, whose RecentDocs artifact reconstructs the path to a KeePass database holding Gogs credentials. The internal Gogs 0.13.3 instance falls to CVE-2025-8110 symlink based RCE for a shell as git on the toolkits host, and the exfiltrated gogs.db hands over a PBKDF2 hash that cracks in under a minute against a password-policy trimmed wordlist, becoming nvirelli and user.txt. Reaching root.txt requires pivoting a chisel SOCKS tunnel into the internal 172.16.20.0/24 network, then abusing ESC11: coercing the DC01$ machine account and relaying it to the certificate authority's unencrypted ICPR RPC interface to mint a DomainController certificate, finishing with a DCSync and a pass-the-hash WinRM session as Administrator.

21 min

hackthebox htb windows active-directory

Medium

HTB DanglingTree Complete Writeup: CVE-2026-23760 (SmarterMail Sysadmin Reset), CVE-2026-26119 (Windows Admin Center), DPAPI Credential Manager Dump and ESC1 Dangling Certificate Template Domain Admin

DanglingTree is a HackTheBox Season 11 Hard Windows machine built around one idea, the dangling reference. Enumeration of an anonymous SMB share leaks a low privilege domain credential that unlocks the Windows Admin Center gateway on port 6600, where an RSA OAEP encrypted login yields PowerShell code execution on the Domain Controller. From that foothold an unauthenticated SmarterMail sysadmin password reset (CVE-2026-23760, build 9504 before 9511) is fired at the loopback only mail service through a raw socket, and the resulting PrimarySysAdmin token is abused through the volume mount feature to execute commands as the svc_mail service account. A backup SmarterMail settings.json still holds an encrypted password for noah.b, which is recovered by extracting a hardcoded DES key and IV from SmarterMail.Standard.dll with offline dnfile parsing. Running as noah.b via RunasCs grants user.txt, and a saved cmdkey credential for alex.o is recovered by offline DPAPI decryption of the masterkey using the protected storage derivation. alex.o holds ForceChangePassword over jake.h, and jake.h holds CreateChild over the Certificate Templates and OID containers, which is enough to recreate one of three published but deleted certificate templates as a malicious ESC1 template, request an Administrator certificate with the correct object SID, recover the NTLM hash through PKINIT UnPAC the hash, and pass the hash with smbexec to read root.txt.

21 min

hackthebox htb windows active-directory

Easy

HTB Cohort Complete Writeup (CVE-2026-39987, CVE-2026-41651): SSRF Vhost Discovery, Marimo Pre-Auth WebSocket RCE and PackageKit Pack2TheRoot Root Escalation

Cohort is a HackTheBox Season 11 Linux machine built around a public marketing portal that quietly proxies an internal analyst workspace. The chain starts with an SSRF in the portal's source URL feature, where loopback style addresses are blocked by name but not by every equivalent representation, letting an attacker reach an internal nginx status endpoint. That endpoint discloses the upstream map, including a randomized internal vhost that fronts a Marimo notebook service bound to loopback on the box. Once the vhost is resolved locally and reached through the reverse proxy, Marimo's unauthenticated terminal WebSocket endpoint is abused through CVE-2026-39987 to get command execution as the marimo user and capture user.txt. Escalation to root abuses CVE-2026-41651, known as Pack2TheRoot, a time of check to time of use race condition in PackageKit's D-Bus transaction handling that lets an unprivileged user swap a simulated package install for a malicious one and land a SUID root shell.

21 min

hackthebox htb linux ssrf

Hard

HTB DarkZero Returns Complete Writeup: CVE-2026-33937 (Handlebars AST Injection), Gitea Actions Abuse and Cross Forest Trust Root Escalation

DarkZero Returns is a HackTheBox Season 11 Hard machine built around a two forest Active Directory environment fronted by a single Linux edge host. The chain starts with an unauthenticated Handlebars AST injection in the campaign_message field of a D&D style web app, granting a reverse shell on SRV01. From there, exposed SSH credentials for the domain user josh lead into a Gitea instance reachable through Kerberos SSPI, where a malicious Actions workflow injected via a fork and pull request executes as svc-runner and discloses user.txt. Reaching root.txt requires pivoting a SOCKS tunnel into the internal 172.16.20.0/24 network, then chaining a delegated Active Directory OU right into local root on SRV01, cracking a Domain Admin NTLM hash recovered from a database backup, and forging a golden ticket with a cross forest extra SID to abuse loose SID filtering and land Backup Operators rights on the second forest's Domain Controller.

18 min

hackthebox htb linux windows

Medium

HTB MakeSense Complete Writeup - Client-Side Crypto, Stored XSS & Root PHP Dev Server

MakeSense is a HackTheBox Season 11 Medium Linux machine centered around a WordPress site with a custom 'webagency' theme. The exploitation chain begins with enumerating a client-side voice/contact feature that encrypts data using a hardcoded JavaScript key before sending to WordPress via admin-ajax.php. An attacker can forge encrypted payloads using the exposed key, first creating a contact submission and then attaching a forged encrypted 'summary' containing a stored XSS payload. When the admin bot opens the submission in /wp-admin, the XSS executes and creates a new administrator account (svc_wp). Logging in as svc_wp allows uploading a malicious plugin ZIP for PHP code execution as www-data. The wp-config.php file leaks SSH credentials for user walter, granting a shell and user.txt. Privilege escalation comes from a root-owned PHP development server bound to 127.0.0.1:8001 running an OCR web app that saves recognized text to arbitrary filenames in its web root. By saving a PHP webshell as shell.php, full root command execution is achieved and root.txt is captured.

16 min

hackthebox htb wordpress client-side-encryption

Hard

HTB Nimbus Complete Writeup - SSRF, IMDS Credential Theft, LocalStack Abuse & modprobe Container Escape

Nimbus is a HackTheBox Season 11 Hard Linux machine centered around a cloud-themed internal job scheduler running on Nginx. The exploitation chain begins with an unauthenticated SSRF vulnerability in the /jobs/preview endpoint, where an octal/decimal-encoded IP bypasses the metadata blocklist to reach the EC2 Instance Metadata Service (IMDS) and steal temporary credentials for the nimbus-web-role IAM role. These credentials are used to enumerate a LocalStack AWS emulator ('floci') fronted by aws.nimbus.htb, revealing an SQS nimbus-jobs queue. Malicious YAML is injected into the queue, exploiting unsafe deserialization in the worker to achieve arbitrary Python code execution inside a Docker container and exfiltrate user.txt. The critical realization that IAM authorization is only enforced at the proxy layer allows direct communication with floci:4566 using default test credentials, granting full root-level AWS access. This access is leveraged to spin up a privileged CodeBuild container, bypass the gosu privilege-drop via a BASH_FUNC_id%% environment variable override, and abuse the modprobe usermode-helper by writing a malicious script to /proc/sys/kernel/modprobe and triggering it with a bad-magic binary execution - achieving full host root and capturing root.txt.

10 min

hackthebox htb linux cloud

Easy

HTB Paperwork Complete Writeup - LPD Command Injection, PJL Path Traversal & SCM_RIGHTS FD Leak

Paperwork is a HackTheBox Season 11 Easy Linux machine themed around custom printer and spooler protocol implementations. The exploitation chain begins with an unauthenticated LPD (Line Printer Daemon) command injection vulnerability in server.py, where a job name containing shell metacharacters breaks out of a subprocess.Popen call with shell=True, yielding a reverse shell as the lp user. From lp, the internal JetDirect/PJL service on port 9100 is accessed, revealing a path-traversal vulnerability in jetdirect.py's _translate() function that fails to sanitize .. sequences. This allows writing an attacker-controlled SSH public key to /home/archivist/.ssh/authorized_keys, granting SSH access as the archivist user and capturing user.txt. The final privilege escalation targets a root-owned Unix-socket management daemon (/usr/bin/paperwork-daemon) that monitors /home/archivist/printer/logs/commands.log for suspicious PJL commands. By writing FSUPLOAD into the log, the daemon enters a lockdown branch that sends two file descriptors over the Unix socket using SCM_RIGHTS ancillary data - including the admin_fd opened as root for /etc/paperwork/admin_pins.conf. Receiving this leaked fd grants the archivist user direct read access to the root-only file via os.pread(), bypassing all filesystem permissions and recovering the root password for full host compromise and root.txt.

11 min

hackthebox htb linux easy-difficulty

Medium

HTB Checkpoint Complete Writeup - AD Recycle Bin Abuse, Malicious VSIX Supply Chain, BadSuccessor dMSA PrivEsc & NTDS.dit Extraction from VM Backup

Checkpoint is a HackTheBox Medium Windows machine running Windows Server 2025 as a Domain Controller. The attack chain starts with low-privilege credentials for alex.turner, who has WRITE access on the AD Recycle Bin container and CREATE_CHILD on the Employees OU. Restoring the deleted user mark.davies and enabling AS-REP roasting recovers reused credentials, granting WRITE on the DevDrop SMB share. A malicious VS Code extension dropped to that share is auto-installed by a scheduled task running as ryan.brooks, yielding the user flag. Privilege escalation uses ryan.brooks's CreateChild permission on the dMSA-holder OU to perform the BadSuccessor attack against svc_deploy, extracting its NT hash from the KERB-DMSA-KEY-PACKAGE Kerberos structure. svc_deploy is in BackupAccess, which grants READ on a VMBackups share containing a VHDX disk image. Mounting the image and extracting NTDS.dit with the SYSTEM hive produces the Administrator NT hash, completing a Pass-the-Hash takeover of the domain.

27 min

hackthebox htb season11 windows

Easy

HTB Connected Complete Writeup - CVE-2025-57819 FreePBX Pre-Auth RCE, PHP Webshell, Incron Abuse & fwconsole-commands Hook PrivEsc

Connected is a HackTheBox Easy Linux machine (CentOS 7) running FreePBX 16.0.40.7 on ports 80 and 443. The attack chain starts with CVE-2025-57819, a critical pre-authentication vulnerability that chains a PHP namespace-based authentication bypass with SQL injection in the /admin/ajax.php endpoint's brand parameter. The injected SQL plants a cron job that writes a PHP webshell to the web root within 60 seconds, landing a shell as the asterisk service account and revealing the user flag. Privilege escalation abuses incron - a filesystem event-driven cron daemon - which monitors /var/spool/asterisk/incron/ as root. The asterisk user can write filenames to that directory, and by crafting a filename following the module.hook.params convention and encoding a command as zlib+base64 to bypass shell metacharacter filtering, the sysadmin_manager script executes our payload as root via the api/fwconsole-commands hook, copying the root flag to the web root for retrieval.

24 min

hackthebox htb linux freepbx

Medium

HTB DevHub Complete Writeup - CVE-2026-23744 MCPJam RCE, JupyterLab WebSocket Code Execution & OPSMCP Admin Tool Abuse

DevHub is a HackTheBox Season 11 Medium Linux machine built around a developer tooling stack running entirely on localhost. The attack chain starts with CVE-2026-23744, an unauthenticated RCE in MCPJam Inspector <= 1.4.2 where crafted HTTP requests trigger MCP server installation and arbitrary command execution. From the initial shell, internal enumeration reveals a JupyterLab instance running as analyst with its auth token exposed in process arguments, exploitable via the Jupyter REST API and WebSocket kernel protocol without any browser interaction. Source code of the OPSMCP Flask API running as root contains a hardcoded API key and a hidden admin tool named ops._admin_dump. Calling this tool with the target ssh_keys argument returns root's OpenSSH private key, completing the chain from unauthenticated network access to full root.

13 min

hackthebox htb linux cve-2026-23744

Easy

Hackthebox Reactor Complete Writeup - CVE-2025-55182 Next.js RCE, SQLite Credential Dump, MD5 Cracking & Node.js Inspector PrivEsc

Reactor is a HackTheBox Medium Linux machine running a Next.js 15.0.3 web application on port 3000. The attack chain starts with CVE-2025-55182, a critical unauthenticated RCE in Next.js that allows arbitrary command execution via a crafted React Flight payload, landing a shell as the node user. Post-exploitation reveals a SQLite database containing MD5-hashed credentials for two users. Hashcat cracks the engineer hash against rockyou.txt in seconds. Direct SSH does not work so lateral movement is achieved via su from the existing shell, recovering the user flag. Privilege escalation abuses a Node.js Inspector debug socket on localhost port 9229, using the node inspect client to execute system commands via child_process.execSync and read the root flag directly.

12 min

hackthebox htb linux nextjs

Insane

HTB PingPong Complete Writeup - ESC13, Cross-Domain DACL, gMSA, JEA, RBCD & ESC4→ESC1

PingPong is a HackTheBox Season 10 Insane Windows machine built around a bidirectional forest trust between ping.htb (DC1) and pong.htb (DC2, hidden on 192.168.2.0/24). NTLM is disabled domain-wide - every step is Kerberos-only. The chain begins with ESC13, an ADCS vulnerability where a certificate template's issuance policy is linked to a security group via msDS-OIDToGroupLink, causing the KDC to inject the group's SID into the PAC at PKINIT time. This grants WinRM access without the user being a member of the group. From there, ownership of a cross-domain group (PING\IT owns PONG\gMSA Managers) is abused by converting the group scope to DomainLocal and adding a Foreign Security Principal, enabling ReadGMSAPassword on Pong_gMSA$. The gMSA credentials unlock a restricted JEA endpoint on DC1 that leaks c.carlssen's password from PSReadLine history, giving WinRM access to DC2 and the user flag. Privilege escalation continues through GenericWrite on svc_sql to set RBCD, S4U impersonation to obtain MSSQL sysadmin, SeImpersonatePrivilege via GodPotato to add c.carlssen to DC2 Administrators, DCSync to recover R.Martinelli (a cross-domain CA Manager), and finally ESC4 to write ESC1 conditions onto the SmartcardAuthentication template before PKINIT as Administrator@ping.htb yields the root flag.

36 min

hackthebox htb windows active-directory

Medium

HTB Logging Complete Writeup - CVE-2025-59287, Shadow Credentials & WSUS MITM

Logging is a HackTheBox Season 10 Medium Windows machine centered around a Domain Controller running Windows Server Update Services (WSUS). The exploitation chain begins with CVE-2025-59287, an unauthenticated unsafe deserialization vulnerability in WSUS that grants remote code execution without any credentials. Credentials for svc_recovery are then discovered in an SMB log file, which after Kerberos-only authentication and clock synchronization are used to abuse GenericAll rights over the msa_health$ Managed Service Account via shadow credentials. A shell is obtained as msa_health$, from which a DLL hijack against a scheduled monitoring task yields lateral movement to jaylee.clifton. The privilege escalation pivots through a DNS spoofing attack that redirects the DC's WSUS client to a fake WSUS server, delivering a malicious executable that runs as SYSTEM.

24 min

hackthebox htb active-directory domain-controller

Easy

HTB Silentium Complete Writeup -CVE-2025-58434, CVE-2025-59528 & Gogs RCE

Silentium is a HackTheBox Season 10 machine built around a Flowise 3.0.5 AI workflow platform exposed on a staging subdomain. The exploitation chain begins with CVE-2025-58434 - an unauthenticated password reset token disclosure - to take over the ben account, then leverages CVE-2025-59528, a critical CVSS-10 JavaScript code injection flaw in the Flowise CustomMCP node, to land a shell inside the Docker container. SSH credentials are extracted from process environment variables, yielding a proper shell as ben. The privilege escalation pivots through a locally bound Gogs 0.13.3 instance vulnerable to CVE-2025-64111, a symlink bypass that allows overwriting .git/config with a poisoned sshCommand, ultimately executing commands as root.

11 min

hackthebox htb linux cve-2025-58434

Hard

Garfield HackTheBox Writeup- Hard Windows Active Directory Machine Walkthrough

A comprehensive walkthrough of the Garfield machine from HackTheBox. This Hard-difficulty Windows Active Directory machine writeup covers abusing writable ACLs to plant a malicious logon script via scriptPath, gaining code execution as l.wilson, resetting the l.wilson_adm password for lateral movement, pivoting to an internal Read-Only Domain Controller through a Ligolo tunnel, creating a fake machine account for Resource-Based Constrained Delegation, dumping the krbtgt_8245 AES256 key from RODC01 using Mimikatz, modifying the RODC password replication policy, forging an RODC Golden Ticket with Rubeus, performing a KeyList attack against DC01 to obtain a legitimate Administrator TGT, and fully compromising the domain via NTDS dump. An essential resource for penetration testers studying multi-step Active Directory exploitation chains.

16 min

hackthebox htb garfield windows

Medium

HTB DevArea Complete Writeup - CVE-2022-46364 Apache CXF LFI & HoverFly RCE

DevArea is a Medium-difficulty HackTheBox machine from Season 10 featuring an internal developer platform exposed across multiple services. The exploitation chain begins with anonymous FTP access to a leaked JAR file, which reveals an Apache CXF SOAP service vulnerable to a critical XOP/MTOM Local File Inclusion (CVE-2022-46364 / CVE-2022-46363). Reading the HoverFly systemd service file leaks admin credentials, which are used to authenticate against the HoverFly Admin API and obtain a JWT token. From there, a malicious middleware payload injected via the /api/v2/hoverfly/middleware endpoint delivers a reverse shell as dev_ryan. Privilege escalation to root exploits a world-writable /bin/bash binary combined with a sudo-permitted script to plant a root-owned SUID shell. This writeup provides a complete step-by-step walkthrough with detailed technical analysis of each exploitation stage.

17 min

hackthebox htb linux cve-2022-46364

Easy

HTB Kobold Complete Writeup - CVE-2026-23744 MCP Inspector RCE & Docker Escape

Kobold is an Easy-difficulty HackTheBox machine from Season 10 built around modern AI tooling infrastructure. The attack chain begins with subdomain enumeration uncovering an MCPJam Inspector instance vulnerable to CVE-2026-23744 - a critical unauthenticated RCE in the /api/mcp/connect endpoint that allows arbitrary command execution via a crafted serverConfig payload. This delivers a reverse shell as the user ben. Privilege escalation exploits an implicit Docker group membership accessible via newgrp docker, which is leveraged to mount the host filesystem inside a root-running MySQL container and read the root flag directly - a textbook Docker socket escape. This writeup provides a complete step-by-step walkthrough with beginner-friendly explanations of each technique.

14 min

hackthebox htb linux cve-2026-23744

From Zero to Root: A Beginner's Complete Guide to Solving HTB Easy Machines in 2026

New to Hack The Box? This complete 2026 beginner's guide walks you through every step - from setting up your VPN to rooting your first Easy machine. Tools, methodology, tips, and real examples inside.

9 min

HackTheBox HTB CTF Beginner

Medium

HTB VariaType Complete Writeup - CVE-2025-66034 & Font Exploitation

VariaType is a cutting-edge HackTheBox machine from Season 10 featuring a web-based variable font generator. The exploitation chain involves chaining three critical vulnerabilities-fontTools CVE-2025-66034 for initial webshell creation, FontForge CVE-2024-25081 for lateral privilege escalation to the steve user, and a setuptools PackageIndex path traversal vulnerability for root access. This writeup provides complete step-by-step instructions with detailed technical analysis of each exploit mechanism.

20 min

hackthebox htb linux cve-2025-66034

Easy

CCTV HackTheBox Writeup - Season 10 Linux Machine Walkthrough

A comprehensive walkthrough of the CCTV machine from HackTheBox Season 10. This Medium-difficulty Linux machine writeup covers ZoneMinder default credentials, exploiting CVE-2024-51482 SQL injection to extract and crack bcrypt hashes, leveraging a tcpdump Linux capability to sniff plaintext credentials from Docker network traffic, SSH port forwarding to expose an internal MotionEye instance, and achieving root via CVE-2025-60787 remote code execution using Metasploit. A must-read for penetration testers tackling multi-step Linux exploitation chains.

16 min

hackthebox htb cctv linux

Hard

Pirate HackTheBox Writeup - Complete Season 10 Machine Walkthrough

A comprehensive walkthrough of the Pirate machine from HackTheBox Season 10. This Hard-difficulty Windows machine writeup covers initial access with provided credentials, Active Directory enumeration, lateral movement strategies, privilege escalation techniques, and achieving SYSTEM access. Learn how to compromise this challenging HTB Windows machine with detailed methodology, practical command examples, and SEO-optimized content for cybersecurity professionals.

33 min

hackthebox htb pirate windows

Medium

Interpretor HackTheBox Writeup - Complete Machine Walkthrough

A comprehensive walkthrough of the Interpretor machine from HackTheBox. This writeup covers reconnaissance, enumeration techniques, initial foothold exploitation, lateral movement strategies, and privilege escalation to root. Learn how to compromise this challenging HTB machine with detailed methodology and practical command examples.

14 min

hackthebox htb Mirth Connect PBKDF2

Easy

WingData HackTheBox Walkthrough - Season 10 Full Exploit & Root Guide

WingData is a HackTheBox Season 10 machine that challenges players with realistic enumeration, service exploitation, and privilege escalation techniques. This walkthrough breaks down the full attack chain from initial reconnaissance to root, with clear commands and practical reasoning for each step.

16 min

htb hackthebox wingdata season 10

Insane

Hack The Box Sorcery Writeup (Season 8) - Complete Walkthrough | Insane Linux Machine

Sorcery is a Medium difficulty Linux machine from Hack The Box Season 8 that focuses on web application exploitation, misconfigurations, and privilege escalation techniques. In this walkthrough, we perform full reconnaissance, identify the attack surface, exploit vulnerabilities to gain initial access, and escalate privileges to root. This guide breaks down every phase of the attack chain with practical methodology and command examples, making it ideal for penetration testers, red teamers, and HTB players preparing for real-world scenarios.

53 min

hackthebox htb hackthebox htb

Medium

Pterodactyl Hack The Box Write-Up-Medium Linux Machine Walkthrough

This write-up covers the full compromise of the Pterodactyl machine from Hack The Box, a Medium-difficulty Linux challenge. It walks through initial reconnaissance, service enumeration, vulnerability discovery, exploitation paths, and the privilege escalation techniques required to achieve root access. Ideal for penetration testers and CTF players looking to sharpen real-world Linux exploitation skills and structured attack methodology.

14 min

htb hackthebox linux medium

Easy

Facts Hack The Box Writeup-Sudo Privilege Escalation via Facter (Linux)

In this walkthrough of the Facts machine from Hack The Box, we exploit a misconfigured sudo rule allowing the execution of Facter as root. By abusing Facter's --custom-dir option, we load a malicious Ruby fact file that executes with UID 0. Instead of spawning an unstable shell, we apply the SetUID bit to /bin/bash, gaining a persistent root shell via bash -p. This writeup covers enumeration, attack reasoning, exploitation mechanics, and a clean privilege escalation path to root.

9 min

htb Linux htb hackthebox

Easy

Conversor Hack The Box Writeup & Walkthrough (XSLT Injection, Linux PrivEsc)

Step-by-step Conversor Hack The Box walkthrough covering XSLT injection, remote code execution, reverse shell via cron jobs, SQLite credential extraction, SSH access, and Linux privilege escalation using CVE-2024-48990 (needrestart). Ideal for penetration testers, red teamers, and CTF players seeking real-world Linux exploitation techniques.

11 min

hackthebox htb linux xslt-injection

Medium

Signed Hack The Box Writeup & Walkthrough (Windows, AD CS, Certificate Abuse)

Step-by-step Signed Hack The Box walkthrough covering Windows enumeration, Active Directory Certificate Services (AD CS) abuse, certificate-based authentication attacks, lateral movement, and privilege escalation to SYSTEM. Ideal for penetration testers, red teamers, and CTF players focusing on modern Active Directory attack paths.

36 min

hackthebox htb windows active-directory

Insane

Hercules HackTheBox Writeup & Walkthrough (Active Directory, Windows, PrivEsc)

Step-by-step Hercules HackTheBox walkthrough for 2026. Learn enumeration, Windows and Active Directory exploitation, privilege escalation, and CTF skills. Ideal for penetration testers, red teamers, and cybersecurity enthusiasts seeking real-world attack paths and solutions.

80 min

htb windows kerberos nxc

Hard

HTB Fries-complete Writeup

Fries is a full enterprise-style attack chain where a leaked pgAdmin credential leads to Docker RCE, NFS loot, LDAP credential capture, and finally AD CS (ESC6 + ESC16) abuse to forge an Administrator certificate. It's a complete pivot-through-every-layer machine ending in total domain compromise.

52 min

htb windows nmap pwm

Medium

HackTheBox Gavel Walkthrough (Linux - Medium)

This HackTheBox Gavel writeup provides a full walkthrough for the Linux Medium machine from Season 9. it covers the entire exploitation chain, including enumeration, misconfiguration discovery, service abuse, gaining an initial foothold, and achieving root through privilege escalation. This guide is designed for learners who want a clear, realistic, attacker-focused approach to solving HTB gavel machine and improving their penetration testing skills.

5 min

pentesting htb hackthebox

Easy

Eighteen - HTB S9 machine Writeup

From low MSSQL creds to DA via impersonation, web hash crack, and WinRM. Abuse Bad Successor (dMSA) on Server 2025 to dump NTDS and take Administrator.

9 min

htb writeups activemachines hackthebox

Hard

HTB NanoCorp

A full walkthrough of HTB NanoCorp, covering Windows exploitation, Active Directory abuse, NTLM relay, and privilege escalation techniques.

8 min

HackTheBox HTB Writeup NanoCorp Windows Exploitation

Easy

HTB CodePartTwo Walkthrough

A full walkthrough and exploitation guide for the HTB CodePartTwo machine, covering enumeration, vulnerability analysis, exploitation, and privilege escalation.

7 min

pentesting htb hackthebox

Hard

Guardian HTB

A step-by-step penetration testing walkthrough of the Guardian machine on HackTheBox.

18 min

pentesting htb hackthebox

Hard

DarkZero HTB

A detailed walkthrough of the HackTheBox DarkZero machine including initial enumeration, database exploitation, and privilege escalation to domain admin.

6 min

pentesting htb hackthebox

Easy

HackTheBox Expressway

A detailed walkthrough of the HackTheBox Expressway machine including initial enumeration, foothold, and privilege escalation.

5 min

pentesting htb hackthebox