Just finished the Checkpoint machine on Hack The Box (Medium difficulty) and it was a really enjoyable Active Directory box with some modern and creative attack paths.

I started with the provided credentials for `alex.turner`. After some enumeration I discovered that a previously deleted account (`mark.davies`) could be restored and that this account had write access to a share called DevDrop. This share was used by the organisation to stage VS Code extensions.

By creating a malicious VSIX extension targeting VS Code engine version 1.118.0 and dropping it on the share, a scheduled task automatically installed the extension and gave me a reverse shell as `ryan.brooks`. This was a really clean example of abusing enterprise software deployment processes.

From the `ryan.brooks` foothold I used Rubeus to obtain a TGT, then leveraged bloodyAD to create a malicious dMSA under a writable OU and impersonated a higher-privileged account. This eventually granted access to a VMBackups share containing a Windows Server memory dump. Using Volatility I extracted the local Administrator NTLM hash from the dump, authenticated with Evil-WinRM, and captured the root flag.

Overall, Checkpoint does a great job of chaining together several current techniques: writable shares for extension abuse, deleted object restoration, dMSA abuse, and memory forensics. It’s a solid Medium box that feels realistic and rewards careful enumeration.

Would recommend it to anyone working on modern Windows / Active Directory attack paths.

#HackTheBox #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #HTB #InfoSec #WindowsSecurity #PrivilegeEscalation #Kerberos #MemoryForensics …

Learn MoreHack The Box: Checkpoint Machine Walkthrough Medium Difficulty

The post Hack The Box: Checkpoint Machine Walkthrough Medium Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Devhub (Medium).

Devhub was a great exercise in exploring modern development tooling, service misconfigurations, and Linux privilege escalation. The journey began with web enumeration and identifying an exposed MCP Inspector service. Further investigation revealed a command injection vulnerability that provided initial access to the machine.

From there, internal service enumeration uncovered a localhost-only Jupyter instance. Accessing it through SSH port forwarding and investigating its authentication mechanism opened the path to another user. The final stage involved examining an internal operations service, understanding its exposed functionality, and identifying a weakness that ultimately led to root access.

Devhub highlights how development tools, internal services, and poorly secured administrative functionality can create unexpected attack paths when combined. Another valuable machine for practising enumeration, lateral movement between local users, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #MCP #InfoSec …

Learn MoreHack The Box: Devhub Machine Walkthrough – Medium Difficulty

The post Hack The Box: Devhub Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine, SmartHire, rated Medium difficulty.

The attack path started with the SmartHIRE web application and its MLflow integration. Enumeration of the application exposed a vulnerable model workflow that allowed a reverse shell as the low-privileged svcweb user. After gaining access to the host, further enumeration revealed opportunities for privilege escalation.

The escalation path focused on the MLflow control script, which allowed malicious plugin code to execute with root privileges. This ultimately enabled the creation of a SUID Bash binary and provided a root shell. The final step was reading /root/root.txt to retrieve the root flag.

This machine provided a practical look at attacking MLflow-based applications, moving from web application exploitation to Linux privilege escalation, and chaining multiple weaknesses to achieve full system access.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #WebSecurity #Linux #MLflow #PrivilegeEscalation #OffensiveSecurity #RedTeam #EthicalHacking #InfoSec #CyberSecurityLearning #CTF #HTBWriteup …

Learn MoreHack The Box: Smarthire Machine Walkthrough – Medium Difficulity

The post Hack The Box: Smarthire Machine Walkthrough – Medium Difficulity appeared first on Threatninja.net.

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec …

Learn MoreHack The Box: Logging Machine Walkthrough – Medium Difficulty

The post Hack The Box: Logging Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Just completed the DevArea machine from Hack The Box!

After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking …

Learn MoreHack The Box: DevArea Machine Walkthrough – Medium Difficulty

The post Hack The Box: DevArea Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.