Completed another Hack The Box machine, Silentium.
Initial access was achieved by exploiting a password-reset vulnerability in the staging Flowise application, followed by abusing a custom MCP endpoint to obtain a root shell inside the Flowise container. Credentials exposed through the container environment were then used to SSH into the underlying host as ben and retrieve the flag.
For privilege escalation, an internal Gogs instance was discovered through local port forwarding. A malicious symlink was pushed and manipulated through the Gogs API to target /etc/sudoers.d/ben, allowing a passwordless sudo rule to be written and ultimately providing full root access.
Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.
The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.
The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.
Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.
The Massachusetts Institute of Technology team won NASA’s LunaRecycle Challenge competition for their project, Composites for Extraterrestrial Recycling By Engineering the Reuse and Upcycling of Zotek (CERBERUZ).
Credit: NASA/Savannah Bullard
NASA named a team from the Massachusetts Institute of Technology (MIT) as the first prize winner for Phase 2 of the agency’s LunaRecycle Challenge, which focused on developing solutions for reducing waste during missions to the Moon or deep space by recycling common materials, like fabrics, plastics, foam, and metals.
The Composites for Extraterrestrial Recycling By Engineering the Reuse and Upcycling of Zotek (CERBERUZ) team, comprised of undergraduate, graduate, and doctoral students at MIT, received a total of $775,000 in awards.
The technology grinds mixed trash into a fine powder, repurposing materials such as Zotek foam as reinforcement rather than treating it as contamination that needs to be sorted out. The powder becomes feed for use as injection-mold finished parts or 3D-printing filament. The MIT team won in both the competition’s prototype development track and in the track focused on developing virtual models, known as “digital twins,” of recycling systems.
“The LunaRecycle Challenge finale is the culmination of two years of innovation spurred by this competition,” said Jennifer Edmunson, program manager for Centennial Challenges at NASA’s Marshall Space Flight Center in Huntsville, Alabama. “It’s incredible to see these technologies go from concept to prototype and digital twin demonstrations in that time. Driving rapid and creative innovation is what NASA challenges are all about.”
LunaRecycle is a $3 million, two-phase competition in partnership with The University of Alabama Lee J. Styslinger Jr. College of Engineering. Phase 2 of the competition required U.S. teams to submit a prototype, with an optional digital twin serving as a virtual model of it.
For Phase 2, 14 finalist teams from across the United States gathered at The University of Alabama’s Lee J. Styslinger Jr. College of Engineering, in Tuscaloosa, from Aug. 24 to Aug. 28 to demonstrate their technology prototypes. The digital twin models submitted by some teams were also presented alongside their respective prototypes.
The competitors’ backgrounds ranged from university students and faculty to entrepreneurs and space technology enthusiasts. Teams were encouraged to envision solutions that not only addressed recycling in deep space, but that also could have applications on Earth.
Along with the first prize winner, nine teams received prizes:
Prototype track winners:
Second place overall ($225,000): Terasynth from Orlando, Fla. with Lunar Re-Forge System
Most Innovative ($50,000): RECLAIM from Penn State University with the Resource Extraction and Conversion from Lunar Anthropogenic Inputs with Microwaves (RECLAIM) system
Highest Mass Efficiency ($50,000): Cislune from Rosemead, Calif. with the Carbon Recovery and Feedstock Transformation for Extraterrestrial Reuse (CRAFTER) system
Most Trash Types Recycled ($50,000): Team Lovegrove from Bob Jones University in Greenville, S.C. with LunaBrix
Additional digital twin track winners:
Second place overall ($125,000): Moon Made from Boulder, Co. with Fiber Forge
Most Innovative ($25,000): RECLAIM from Penn State University with the RECLAIM system
Best Visualization ($25,000): Waste Parrot Technologies from New York, N.Y.
People’s choice winner ($25,000):
Terasynth from Orlando, Fla. with Lunar Re-Forge System
“This competition highlights how collaborations can lead to incredible solutions,” said Chris Frangione, who manages the LunaRecycle Challenge in support of NASA Centennial Challenges contracted through Amentum Space Exploration Division. “Between the solver teams, The University of Alabama, and NASA, this finale showcases what can be achieved when we bring together resources and great ideas towards a common goal.”
The Phase 2 awards follow the success of the competition’s Phase 1, which received record-breaking interest from the global innovator community with more than 1,200 registrations – more than any competition in the 20-year history of NASA Centennial Challenges. For Phase 1, which concluded in 2025, participants from around the world could submit designs in either or both of the prototype or digital twin tracks. A panel of 50 judges evaluated nearly 200 Phase 1 submissions, selecting 17 teams representing five countries and nine U.S. states as winners. Phase 2 entries were required to be unrelated to Phase 1.
The LunaRecycle Challenge is managed at NASA’s Marshall Space Flight Center by Centennial Challenges, part of the Prizes, Challenges, and Crowdsourcing program within NASA’s Research and Technology Mission Directorate. NASA’s Centennial Challenges have a legacy of more than 20 years engaging the public to solve complex problems that benefit NASA’s broader initiatives. Past challenges have spurred advances in robotics, additive manufacturing, power and energy, textiles, chemistry, and biology.
LunaRecycle is also supported by subject matter experts at NASA’s Kennedy Space Center in Florida, NASA’s Ames Research Center in California’s Silicon Valley, and NASA’s Langley Research Center, in Hampton, Virginia.
NASA will announce the winners of the final phase of its LunaRecycle Challenge on Friday, Aug. 28, at The University of Alabama (UA) Lee Styslinger College of Engineering in Tuscaloosa, Alabama. Launched in 2024, the challenge incentivizes the invention of new recycling systems that could support non-metabolic waste management efforts for future lunar missions.
Media and the public are invited to the challenge’s Technology Showcase and Winners Announcement, where up to 14 finalist teams will showcase their solutions and hear from NASA and UA leadership about the future of lunar innovation. Opening remarks will begin at 8:30 a.m. CDT on Aug. 28, in Room 1026 of H.M. Comer Hall on the UA campus.
Media interested in covering the event should confirm their attendance with the NASA Marshall newsroom by 3 p.m., Wednesday, Aug. 27, at: joel.w.wallace@nasa.gov.
The LunaRecycle Challenge is a $3 million, two-phase competition focused on the design and development of recycling solutions that can reduce non-metabolic waste and improve the sustainability of longer-term lunar missions. In the Final Round of Phase 2, invited teams were tasked with refining their prototype and digital twin concepts in preparation for live testing at McAbee Construction in Tuscaloosa earlier this month.
After this event, up to 11 teams will receive a portion of the $1.325 million prize purse from NASA for their prototype and digital twin solutions. The top two prototypes will earn $500,00 and $225,000, while top two digital twins will receive $275,000 and $125,000. Up to six Technical Achievement Prizes will be awarded to teams who excel in categories determined by the judging panel during final deliberations. Additionally, a $25,000 People’s Choice Award will be presented to the team who receives the most votes from the public and stakeholders throughout the Technology Showcase.
Winners will be announced live during the Technology Showcase closing ceremony, which begins at 12 p.m.
The LunaRecycle Challenge is managed at NASA’s Marshall Space Flight Center by Centennial Challenges, part of the Prizes, Challenges, and Crowdsourcing Program within NASA’s Research and Technology Mission Directorate. NASA’s Centennial Challenges have a legacy of more than 20 years engaging the public to solve complex problems that benefit NASA’s broader initiatives. Past challenges have spurred advances in robotics, additive manufacturing, power and energy, textiles, chemistry, and biology.
Phase 1 of the competition received record-breaking interest from the global innovator community. The challenge received more than 1,200 registrations – more than any competition in the 20-year history of Centennial Challenges – and a panel of 50 judges evaluated nearly 200 submissions. Seventeen teams were selected as Phase 1 winners, representing five countries and nine U.S. states, announced via livestream on NASA Marshall’s YouTube channel.
The LunaRecycle Challenge also is supported by recycling subject matter experts at NASA’s Kennedy Space Center in Florida and NASA’s Ames Research Center in California’s Silicon Valley. The University of Alabama Lee J. Styslinger Jr. College of Engineering executes the challenge in partnership with NASA.
To learn more about the LunaRecycle Challenge visit:
Preparations for Next Moonwalk Simulations Underway (and Underwater)
The Orbital Clarity Challenge — the sixth in the NASA TechLeap Prize series — is a collaborative effort between NASA’s Heliophysics Division, Flight Opportunities program, and Center of Excellence for Collaborative Innovation. The Heliophysics Division studies space weather, including how it heats and expands Earth’s outer atmosphere during intense solar activity, creating orbital drag through atmospheric density changes. The challenge calls for low-cost methods of measuring thermospheric density, pressure, or drag in low Earth orbit. NASA is seeking approaches that are inexpensive and scalable enough to be produced in quantity and flown as hosted payloads across the commercial fleet. The challenge will unfold across three phases, advancing up to four winners’ concepts to a flight-ready solution within 12 months. At the conclusion of the challenge, NASA intends to offer each winning team a test flight at no cost.
Award: Up to four winners may receive up to $500,000 in prizes across three phases
Preparations for Next Moonwalk Simulations Underway (and Underwater)
Credit: National Institute of Aerospace
NASA’s next Gateways to Blue Skies competition invites collegiate teams to imagine innovative new ways aircraft could inspect land-based infrastructure, such as bridges and tunnels, to improve safety, reliability, and costs by 2035 or sooner.
Infrastructure is the foundation of the nation’s strong economy, global competitiveness, and daily quality of life. When that infrastructure is damaged or in disrepair, it restricts the movement of people, goods, and critical resources like water and energy. Inspections are important throughout the lifetime of infrastructure projects, but they often come with challenges.
Structures such as tunnels, bridges, highways, railways, and electric grids can be massive in size and difficult to reach. They can require disruptive shutdowns to access, or force workers to navigate extreme heights, confined spaces, and hazardous environments. As infrastructure ages and expands, there are opportunities to use innovative airborne platforms to improve current inspection practices.
“The demands for creative solutions like airborne platforms to improve the infrastructure sector are increasing exponentially,” said Steven Holz, Gateways to Blue Skies competition lead, NASA’s Langley Research Center in Hampton, Virginia. “The time is ripe for innovative students to transform how we work with our critical infrastructure, and this competition gives talented students the opportunity to do so.”
Sponsored by NASA’s University Innovation Project, the 2027 Gateways to Blue Skies competition encourages multidisciplinary teams of college students to conceptualize innovations in the world of aviation. Each year, the competition selects a new theme based on a complex challenge facing the Nation. It aims to engage as many students as possible from all backgrounds, majors, and collegiate levels.
The competition is open to teams of two to six students and divided into two phases. In Phase 1, teams will submit a proposal and an accompanying two-minute video, which will be judged by NASA and industry experts. Up to eight finalist teams will each receive a $9,000 prize and advance to Phase 2, where they will present their updated work to a panel of NASA and industry experts at a forum in May 2027. Winners will be offered the opportunity to intern with NASA Aeronautics in the academic year following the forum.
Teams interested in participating in the competition can review guidelines and eligibility requirements posted on the competition website. Teams are encouraged to submit a non-binding Notice of Intent by Monday, Oct. 12, via the website to stay apprised of competition news. Proposal and video submissions are due Feb. 22, 2027. The Gateway to Blue Skies Competition is run by the Aeronautics Division in NASA’s Research and Technology Mission Directorate. NASA’s Center of Excellence for Collaborative Innovation, part of the Prizes, Challenges, and Crowdsourcing Program within the Research and Technology Mission Directorate, manages the challenge contract. The National Institute of Aerospace administers the challenge on behalf of NASA.
NASA Challenge Tests Wheel Designs for Moon Base Mobility
NASA engineers, NASA Robotics Academy students, and teams from the Rock and Roll with NASA Challenge pose with the wheel prototypes at NASA’s Johnson Space Center Rock Yard in Houston on July 31, 2026.
Credits: NASA/Luna Posadas Nava
NASA engineers, NASA Robotics Academy students, and teams from the Rock and Roll with NASA Challenge pose with the wheel prototypes at NASA’s Johnson Space Center Rock Yard in Houston on July 31, 2026.
NASA/Luna Posadas Nava
As NASA prepares to establish the Moon Base, advancing surface mobility will be key to helping crews and robotic systems travel farther across the lunar surface.
To help advance that capability, the Rock and Roll with NASA Challenge invited public innovators to design and build next-generation lunar rover wheels.
Five teams from 128 submissions and 49 countries advanced to the final phase of the competition, where they tested their prototypes on July 31 at NASA’s Johnson Space Center in Houston.
The Huff Helo lunar wheel prototype is tested at Johnson Space Center’s Rock Yard.
NASA/Luna Posadas Nava
The challenge sought lightweight, durable, and scalable wheels that could support longer-duration lunar surface operations. The designs also needed to be compliant enough to absorb impacts, maintain traction at higher speeds, and withstand the harsh lunar environment.
“Every additional kilometer a rover can reliably travel will expand how far we can explore, what science we can achieve, and what infrastructure we can build,” said Ed Herrera, robotics engineer at Johnson and co-leader of the challenge project.
NASA Johnson uses ground prototypes to test mobility technologies, while lunar terrain vehicles will be delivered to the lunar surface through the Commercial Lunar Payload Services initiative. For the challenge, the wheels were fitted to MicroChariot, a 45-kilogram test rover, and put through a series of courses at Johnson’s Rock Yard to evaluate their performance across different types of terrain.
NASA Robotics Academy students navigate the lunar wheel prototype Scotch Pad Tyres fitted on the MicroChariot rover at Johnson’s Rock Yard.
NASA/Luna Posadas Nava
“Crowdsourcing gives us an opportunity to look beyond traditional approaches for lunar wheel design,” Herrera said. “The more wheel technologies we can develop and understand, the more options we have to meet the needs of different vehicles, terrains, and missions on the Moon and Mars.”
Those ideas were reflected in five distinctly different designs.
The HTR Variable Flex Lunar Wheel created by Hellenic Technology of Robotics SA uses an internal system designed to vary the wheel’s stiffness depending on terrain and vehicle needs. The team adapted technology it had been developing for terrestrial wheels for about a decade.
The Hiper Wheel created by Hyperbola uses tensioned cables and a corigated structure that provides spring-like behavior, allowing the wheel to flex without relying on traditional radial spokes.
The Huff Helo Flexible Titanium Wheel created by Huff Helo Inc. uses formed titanium sheet metal as both structure and spring. During testing, the team found that the strength of the design also made the wheel more rigid, causing it to bounce over some obstacles rather than conform to the terrain.
The Payne Aviation Wheel created by Deborah and Craige Payne took inspiration from aviation and history. Its designer, an aircraft mechanic, combined a pneumatic approach with ideas from early automobile tire designs.
The winning Scotch Pad Tyres team poses with their prototype and MicroChariot at Johnson’s Rock Yard.
NASA/Luna Posadas Nava
The winning Scotch Pad Tyres concept came from an Australian mechanical engineer Daniel Bloomfield and his son Isaac Bloomfield. Their prototype uses a Nomex-based tire structure supported around an aluminum hub. The soft material allows the tire to deform around terrain, while internal support helps it maintain its shape. A treated outer surface of epoxy and corundum grit was integrated to improve traction.
The Rock Yard testing also demonstrated why different terrains may require different approaches. Loose material can affect traction, while rocks and slopes place different demands on wheels such as vehicle stability.
The HTR Variable Flex Lunar Wheel prototype sits alongside NASA’s Space Exploration Vehicle at Johnson’s Rock Yard.
NASA/Luna Posadas Nava
As lunar exploration expands, different vehicles will require different combinations of speed, load capacity, durability, and terrain performance.
Seeking that variety was part of the challenge design. The design options gave engineers different technologies to consider and potentially advance.
“This challenge brought in new ideas from outside traditional industries and helped us identify wheel technologies that may be suitable for longer-duration surface operations,” said Lucien Junkin, robotics engineer at Johnson and co-leader of the challenge project.
The next phase could evaluate how the wheels respond to lunar-like dust, vacuum, and extreme temperatures in Johnson’s thermal vacuum chambers. Engineers could also assess the designs over longer distances and at different sizes and loads.
“Mobility is key to everything we want to do on the Moon,” Junkin said. “The farther we want to explore, the more we need to advance the wheel technologies that can get us there.”
The Common Robotics Project of the Robotic Systems Technology Branch within Johnson’s Engineering Directorate conducted the Rock and Roll with NASA Challenge. NASA’s Center of Excellence for Collaborative Innovation, part of the Prizes, Challenges, and Crowdsourcing Program within the Research and Technology Mission Directorate, managed the challenge contract. Students in NASA’s Robotics Academy helped prepare hardware and support the competition, while engineers from NASA’s Glenn Research Center in Cleveland supported reviews of concepts and proposals. HeroX administered the challenge on behalf of NASA.
Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.
Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.
Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.
Preparations for Next Moonwalk Simulations Underway (and Underwater)
Artist’s rendering depicting lunar surface operations at a future base in the lunar South Pole.
NASA
NASA is asking U.S.-based collegiate teams to submit bold, original concepts to the 2027 edition of a student challenge focused on aerospace innovation that could help the agency envision a future on the Moon shaped by new technology.
The latest NASA Revolutionary Aerospace Systems Concepts – Academic Linkage (RASC-AL) competition invites student teams to explore new operations paradigms and advance the technologies needed to support sustained operations in the lunar South Pole region.
“This competition showcases the technical excellence and creativity of the next generation of explorers and innovators,” said Chris Jones, chief technologist, Systems Analysis and Concepts Directorate, NASA’s Langley Research Center in Hampton, Virginia. “The concepts students develop through RASC-AL demonstrate exceptional talent and contribute to the body of work that advances NASA’s missions.”
Since 2002, the annual RASC-AL competition has helped foster aerospace concepts, technology, and prototyping by making connections among universities, NASA, and industry. This year’s competition includes themes ranging from the development of concepts to support prospecting in the permanently shadowed regions of lunar craters to the advancement of critical and expandable infrastructure for future astronauts.
“NASA’s RASC-AL competition connects top university researchers with the agency’s technology and engineering challenges,” said Gabe Merrill, acting cross-program integration lead for the Advanced Research and Technology Division in NASA’s Research and Technology Mission Directorate. “By asking student innovators to design concepts for what our future on the Moon might look like, this competition accelerates the technology we need to explore the Moon and provides a development opportunity for future aerospace innovators and leaders.”
Teams interested in participating are required to submit a non-binding notice of intent by Tuesday, Oct. 13, and will be invited to a Q&A session with NASA experts on Oct. 27.
Challenge proposals and accompanying video submissions are due Feb. 24, 2027. Proposals should demonstrate innovative solutions supported by original engineering and analysis in response to one of the four 2027 RASC-AL themes:
Enabling extreme exploration
Transit pathway construction
Lunar resource exploration
Smart and resilient lunar habitat
The competition will select as many as 14 teams to advance to its final phase, which involves further developing their concepts, writing a technical paper, and creating a technical poster. Each finalist team will receive a $7,500 award to facilitate its full participation. Finalists will present their concepts to a panel of NASA and industry experts at the 2027 RASC-AL Forum in Cocoa Beach, Florida, June 7 to 10, 2027.
The top two overall teams will receive an additional monetary award and an invitation to attend and present their concept at an aerospace conference later in 2027.
Interested student teams are encouraged to visit the official RASC-AL competition website for detailed guidelines and eligibility requirements.
The 2027 NASA RASC-AL Competition is administered by the National Institute of Aerospace on behalf of NASA’s Advanced Research and Technology Division within the Research and Technology Mission Directorate. NASA’s Center of Excellence for Collaborative Innovation, part of the Prizes, Challenges, and Crowdsourcing Program within the Research and Technology Mission Directorate, manages the challenge contract.
Completed the Hack The Box "Kobold" machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation.
The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services.
Just wrapped up another Hack The Box machine: Fries (Hard).
TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.
Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.
The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.
Just completed the CCTV machine from Hack The Box!
After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.
For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.
Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!
Just completed the DevArea machine from Hack The Box!
After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.
For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.
Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!
Login
