Just finished the Insane difficulty Eloquia machine on Hack The Box which one of the more layered and creative Windows boxes I’ve done in a while.

The path starts with a custom Django publishing platform that integrates with a Qoogle OAuth service. After registering and creating articles, you discover that the application trusts certain meta-refresh tags and can be leveraged for redirects. Combined with OAuth authorization flows and a bit of CSRF, this opens the door to higher-privilege access inside the web application.

From the admin interface, SQL Explorer becomes available. Because the backend is SQLite, `load_extension` can be abused to load a malicious DLL. That gives the first reverse shell as the `eloquia\web` user and the user flag.

Privilege escalation requires deeper enumeration. Edge browser credentials stored for the Olivia.KAT account can be extracted and decrypted offline. WinRM then provides a stable shell as that user. From there, Seatbelt and process enumeration reveal an interesting custom service called Failure2Ban that runs with high privileges and periodically restarts. By racing a binary overwrite of `Failure2Ban.exe` with a reverse shell, you land as `NT AUTHORITY\SYSTEM` and grab the root flag.

What made this machine feel genuinely Insane was the number of different skill sets required: web application logic, OAuth/CSRF, SQLite extension loading, Windows credential dumping, service abuse under AppLocker and PowerShell restrictions, and careful timing for the final binary overwrite.

Great learning experience overall.

#HackTheBox #CTF #PenetrationTesting #WindowsPrivilegeEscalation #RedTeam #InfoSec #Eloquia #InsaneBox …

Learn MoreHack The Box: Eloquia Machine Walkthrough – Insane Difficulty

The post Hack The Box: Eloquia Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.

Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.

Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.

#HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 …

Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

The post HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.