Just finished the Insane difficulty Eloquia machine on Hack The Box which one of the more layered and creative Windows boxes I’ve done in a while.

The path starts with a custom Django publishing platform that integrates with a Qoogle OAuth service. After registering and creating articles, you discover that the application trusts certain meta-refresh tags and can be leveraged for redirects. Combined with OAuth authorization flows and a bit of CSRF, this opens the door to higher-privilege access inside the web application.

From the admin interface, SQL Explorer becomes available. Because the backend is SQLite, `load_extension` can be abused to load a malicious DLL. That gives the first reverse shell as the `eloquia\web` user and the user flag.

Privilege escalation requires deeper enumeration. Edge browser credentials stored for the Olivia.KAT account can be extracted and decrypted offline. WinRM then provides a stable shell as that user. From there, Seatbelt and process enumeration reveal an interesting custom service called Failure2Ban that runs with high privileges and periodically restarts. By racing a binary overwrite of `Failure2Ban.exe` with a reverse shell, you land as `NT AUTHORITY\SYSTEM` and grab the root flag.

What made this machine feel genuinely Insane was the number of different skill sets required: web application logic, OAuth/CSRF, SQLite extension loading, Windows credential dumping, service abuse under AppLocker and PowerShell restrictions, and careful timing for the final binary overwrite.

Great learning experience overall.

#HackTheBox #CTF #PenetrationTesting #WindowsPrivilegeEscalation #RedTeam #InfoSec #Eloquia #InsaneBox …

Learn MoreHack The Box: Eloquia Machine Walkthrough – Insane Difficulty

The post Hack The Box: Eloquia Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Devhub (Medium).

Devhub was a great exercise in exploring modern development tooling, service misconfigurations, and Linux privilege escalation. The journey began with web enumeration and identifying an exposed MCP Inspector service. Further investigation revealed a command injection vulnerability that provided initial access to the machine.

From there, internal service enumeration uncovered a localhost-only Jupyter instance. Accessing it through SSH port forwarding and investigating its authentication mechanism opened the path to another user. The final stage involved examining an internal operations service, understanding its exposed functionality, and identifying a weakness that ultimately led to root access.

Devhub highlights how development tools, internal services, and poorly secured administrative functionality can create unexpected attack paths when combined. Another valuable machine for practising enumeration, lateral movement between local users, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #MCP #InfoSec …

Learn MoreHack The Box: Devhub Machine Walkthrough – Medium Difficulty

The post Hack The Box: Devhub Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.

The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.

From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.

For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.

I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.

Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …

Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty

The post Hack The Box: Reactor Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine, Silentium.

Initial access was achieved by exploiting a password-reset vulnerability in the staging Flowise application, followed by abusing a custom MCP endpoint to obtain a root shell inside the Flowise container. Credentials exposed through the container environment were then used to SSH into the underlying host as ben and retrieve the flag.

For privilege escalation, an internal Gogs instance was discovered through local port forwarding. A malicious symlink was pushed and manipulated through the Gogs API to target /etc/sudoers.d/ben, allowing a passwordless sudo rule to be written and ultimately providing full root access.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #CTF …

Learn MoreHack The Box: Silentium Machine Walkthrough – Easy Difficulity

The post Hack The Box: Silentium Machine Walkthrough – Easy Difficulity appeared first on Threatninja.net.

Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.

Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.

Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.

#HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 …

Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

The post HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed the Hack The Box "Kobold" machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation.

The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #Docker #VulnerabilityManagement #CVE #EthicalHacking #CybersecurityLearning …

Learn MoreHack The Box: Kobold Machine Walkthrough – Easy Difficulty

The post Hack The Box: Kobold Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF …

Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty

The post Hack The Box: Fries Machine Walkthrough – Hard Difficulty appeared first on Threatninja.net.

Just completed the CCTV machine from Hack The Box!

After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

The post Hack The Box: CCTV machine walkthrough – Easy Difficulty appeared first on Threatninja.net.

Just completed the DevArea machine from Hack The Box!

After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking …

Learn MoreHack The Box: DevArea Machine Walkthrough – Medium Difficulty

The post Hack The Box: DevArea Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.