Just finished the Checkpoint machine on Hack The Box (Medium difficulty) and it was a really enjoyable Active Directory box with some modern and creative attack paths.

I started with the provided credentials for `alex.turner`. After some enumeration I discovered that a previously deleted account (`mark.davies`) could be restored and that this account had write access to a share called DevDrop. This share was used by the organisation to stage VS Code extensions.

By creating a malicious VSIX extension targeting VS Code engine version 1.118.0 and dropping it on the share, a scheduled task automatically installed the extension and gave me a reverse shell as `ryan.brooks`. This was a really clean example of abusing enterprise software deployment processes.

From the `ryan.brooks` foothold I used Rubeus to obtain a TGT, then leveraged bloodyAD to create a malicious dMSA under a writable OU and impersonated a higher-privileged account. This eventually granted access to a VMBackups share containing a Windows Server memory dump. Using Volatility I extracted the local Administrator NTLM hash from the dump, authenticated with Evil-WinRM, and captured the root flag.

Overall, Checkpoint does a great job of chaining together several current techniques: writable shares for extension abuse, deleted object restoration, dMSA abuse, and memory forensics. It’s a solid Medium box that feels realistic and rewards careful enumeration.

Would recommend it to anyone working on modern Windows / Active Directory attack paths.

#HackTheBox #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #HTB #InfoSec #WindowsSecurity #PrivilegeEscalation #Kerberos #MemoryForensics …

Learn MoreHack The Box: Checkpoint Machine Walkthrough Medium Difficulty

The post Hack The Box: Checkpoint Machine Walkthrough Medium Difficulty appeared first on Threatninja.net.

Just finished the Insane difficulty Eloquia machine on Hack The Box which one of the more layered and creative Windows boxes I’ve done in a while.

The path starts with a custom Django publishing platform that integrates with a Qoogle OAuth service. After registering and creating articles, you discover that the application trusts certain meta-refresh tags and can be leveraged for redirects. Combined with OAuth authorization flows and a bit of CSRF, this opens the door to higher-privilege access inside the web application.

From the admin interface, SQL Explorer becomes available. Because the backend is SQLite, `load_extension` can be abused to load a malicious DLL. That gives the first reverse shell as the `eloquia\web` user and the user flag.

Privilege escalation requires deeper enumeration. Edge browser credentials stored for the Olivia.KAT account can be extracted and decrypted offline. WinRM then provides a stable shell as that user. From there, Seatbelt and process enumeration reveal an interesting custom service called Failure2Ban that runs with high privileges and periodically restarts. By racing a binary overwrite of `Failure2Ban.exe` with a reverse shell, you land as `NT AUTHORITY\SYSTEM` and grab the root flag.

What made this machine feel genuinely Insane was the number of different skill sets required: web application logic, OAuth/CSRF, SQLite extension loading, Windows credential dumping, service abuse under AppLocker and PowerShell restrictions, and careful timing for the final binary overwrite.

Great learning experience overall.

#HackTheBox #CTF #PenetrationTesting #WindowsPrivilegeEscalation #RedTeam #InfoSec #Eloquia #InsaneBox …

Learn MoreHack The Box: Eloquia Machine Walkthrough – Insane Difficulty

The post Hack The Box: Eloquia Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Devhub (Medium).

Devhub was a great exercise in exploring modern development tooling, service misconfigurations, and Linux privilege escalation. The journey began with web enumeration and identifying an exposed MCP Inspector service. Further investigation revealed a command injection vulnerability that provided initial access to the machine.

From there, internal service enumeration uncovered a localhost-only Jupyter instance. Accessing it through SSH port forwarding and investigating its authentication mechanism opened the path to another user. The final stage involved examining an internal operations service, understanding its exposed functionality, and identifying a weakness that ultimately led to root access.

Devhub highlights how development tools, internal services, and poorly secured administrative functionality can create unexpected attack paths when combined. Another valuable machine for practising enumeration, lateral movement between local users, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #MCP #InfoSec …

Learn MoreHack The Box: Devhub Machine Walkthrough – Medium Difficulty

The post Hack The Box: Devhub Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

As an astronaut traverses the lunar South Pole, tribocharging from walking on the lunar surface and plasma charging from the ambient plasma generate electric charge on the spacesuit. This problem is severely compounded when entering lunar shadows and Permanently Shadowed Regions (PSRs). In these dark zones, the spacesuit can buildup a substantial negative potential due to a lack of ambient ion flux and the absence of photoelectron emission to balance ambient electron collection.

The risk occurs when an astronaut returns to the spacecraft. Because the lunar surface lacks a natural environmental mechanism to bleed the charge accumulated on spacesuit away, the astronaut may become a walking, high voltage capacitor.

In the sunlit region, the stationary lander will hold slightly positive electrical potential. When a highly negatively-charged astronaut approaches the vehicle, the extreme voltage differential can trigger electrostatic discharge (an instantaneous electrical arc, or a spark) during physical contact. A rapid discharge from the astronaut to the lander risks degrading vital suit layers, damaging sensitive suit electronics, threatening the oxygen-rich environment inside the suit, and delivering dangerous electrical shocks to the crew.

Through the Lunar Grounding Challenge, NASA is seeking innovative designs and operational solutions to bring a lunar equilibrium capability to safely discharge a suited astronaut from high triboelectric charge buildup during lunar surface EVAs in the South Pole. This challenge seeks innovative concepts for an Electrostatic Discharge (ESD) mitigation solution to neutralize the astronaut in a safe and timely manner under this extreme charge differential before astronauts directly interact with the lander.

Award: Up to $150,000 in prizes

Challenge Open Date: October 5, 2026

Submissions Close Date: January 15, 2027

For more information, visit: https://work.crowdplat.com/challenge/lunar-grounding-challenge

Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge.

The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user.

From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold.

For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell.

I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector.

Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning …

Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty

The post Hack The Box: Reactor Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

NASA’s 2027 Human Lander Challenge is seeking ideas from college and university students to help address one of the most critical needs for sustained lunar exploration: reliable communications.

As NASA prepares for long-term human presence on the Moon through the Artemis and Moon Base programs, communications systems will be just as important as spacecraft and rockets. A resilient communications system will connect astronauts, rovers, habitats, landers, mission support teams on Earth, and more. Reliable communications are essential for ensuring safety, coordinating complex operations, and enabling timely decision-making in the harsh and remote lunar environment.

“Reliable communications will be at the heart of our ability to explore and operate on the Moon,” said Jeremy Del Greco, Human Landing System program communications integration lead at NASA’s Marshall Space Flight Center in Huntsville, Alabama. “As Artemis and Moon Base missions expand our presence beyond Earth, we will need dependable connections across the lunar surface and beyond. The 2027 Human Lander Challenge gives students the opportunity to help shape the communications capabilities of tomorrow and support future lunar exploration.”

The 2027 competition invites United States-based collegiate teams and their faculty advisers to develop innovative, systems-level solutions to better understand, establish, and optimize lunar communications for landers and surface operations that can be implemented within three to five years.

Teams should submit a non-binding notice of intent by Thursday, Oct. 15, if they would like to participate. Proposal packages, including a five to seven-page proposal and a two-minute video, are due March 4, 2027.

While teams may propose solutions outside of the focus areas, NASA has identified three main categories to advance future lunar communications capabilities:

• Hardware:
  • Space-rated wireless networks and electronics
  • Antenna signal propagation, modeling, and environmental mitigation
• Software:
  • Data efficiency and link optimization
  • Network management and scheduling
• Architecture
  • Surface communications system architecture
  • Orbital communications system architecture

Based on proposal package evaluations in phase 1, up to 12 finalist teams will be selected to receive $9,000 and advance to phase 2 of the competition, which includes a final design review in Huntsville, Alabama, home of NASA’s Marshall Space Flight Center, June 21–24, 2027. The top three teams from phase 2 will share a total prize of $18,000.

The Human Lander Challenge is administered by the National Institute of Aerospace on behalf of the agency and supports NASA’s efforts to foster innovative solutions to a variety of areas for long-duration human spaceflight plans at the Moon. The Human Lander Challenge is sponsored by the agency’s Human Spaceflight Mission Directorate’s Human Landing System Program Office.

Through the Artemis program, NASA will send astronauts to explore the Moon for scientific discovery, economic benefits, and to build the foundation for the first crewed missions to Mars – for the benefit of all.

For more information on NASA’s Human Lander Challenge and how to participate, visit:

https://hulc.nianet.org/

Following a successful inaugural year of ingenuity and career building, NASA ORBIT (Opportunities in Research, Business, Innovation, and Technology) has officially returned for a second season to bring university and college student innovation to the forefront of Earth technology development and deep-space exploration.

Registration for the 2026–2027 challenge is open through Monday, Nov. 16, 2026, through the NASA STEM Gateway.

Expanded for its second season with up to $500,000 in total prize funding, NASA’s ORBIT invites student teams to explore their boldest ideas and invent their brightest solutions. Through the competition, students must conduct targeted research, conceptualize early models, and perform feasibility analyses to refine their proposals. Top-performing teams earn a spot at the in-person Pitch Showcase to present their solutions to a panel of expert judges, who select award recipients based on their presentations and interactive Q&A sessions.

ORBIT has two challenge tracks for teams to choose from. Participants in the ORBIT Earth track must select a NASA-owned patent and develop novel commercial or nonprofit applications addressing critical terrestrial problems. Whether reimagining drones for reduced noise pollution or designing improved medical technology for better patient care, students must demonstrate clear pathways to public benefit.

The ORBIT Space focuses on next-generation space exploration technology designed to support NASA’s Artemis program and future initiatives to establish a sustainable human presence on the Moon, Mars, and beyond. Teams competing in this track develop viable concepts for power, communications, navigation, living solutions, astronaut health and well-being, and more.

Projects that successfully unite the goals of both the Earth and Space tracks can also qualify for a special Integration Bonus, but this season also introduces two new specialty recognitions: the Faculty Advisors’ Choice Award, celebrating professionalism and cross-team communications, and the Next Steps Award, recognizing teams with the strongest roadmaps to continuing their project development after the conclusion of the challenge.

Together with core prizes, ORBIT celebrates student excellence and drives key technical solutions while building a pipeline of interdisciplinary talent. The challenge provides students with immersive experience in NASA’s core missions, direct access to agency mentors, and industry-ready skills that bridge academia and aerospace careers.

For complete competition details, eligibility requirements, and official rules, visit: https://nasaorbit.org/

Registration is open until Nov.16, 2026, through the NASA STEM Gateway.

The NASA ORBIT (Opportunities in Research, Business, Innovation, and Technology for the Workforce) Challenge invites university and community college students nationwide to work with real NASA intellectual property and mission challenges.

Choose your path: develop commercial applications of NASA patents that solve problems here on Earth (ORBIT Earth), or design next-generation technologies for space exploration (ORBIT Space). The most ambitious teams can pursue both through the optional Integration Bonus.

Award: Up to $500,000 in prizes, receive mentorship from NASA experts, and present your work at an in-person showcase. Finalists gain access to an exclusive accelerator program designed to launch careers in STEM and entrepreneurship.

Challenge Open Date: September 14, 2026

Registration Close Date: November 16, 2026

For more information, visit: https://nasaorbit.org/

Completed another Hack The Box machine, SmartHire, rated Medium difficulty.

The attack path started with the SmartHIRE web application and its MLflow integration. Enumeration of the application exposed a vulnerable model workflow that allowed a reverse shell as the low-privileged svcweb user. After gaining access to the host, further enumeration revealed opportunities for privilege escalation.

The escalation path focused on the MLflow control script, which allowed malicious plugin code to execute with root privileges. This ultimately enabled the creation of a SUID Bash binary and provided a root shell. The final step was reading /root/root.txt to retrieve the root flag.

This machine provided a practical look at attacking MLflow-based applications, moving from web application exploitation to Linux privilege escalation, and chaining multiple weaknesses to achieve full system access.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #WebSecurity #Linux #MLflow #PrivilegeEscalation #OffensiveSecurity #RedTeam #EthicalHacking #InfoSec #CyberSecurityLearning #CTF #HTBWriteup …

Learn MoreHack The Box: Smarthire Machine Walkthrough – Medium Difficulity

The post Hack The Box: Smarthire Machine Walkthrough – Medium Difficulity appeared first on Threatninja.net.

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge.

This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse.

The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin.

From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account.

The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain.

The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop.

Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets.

Documented as part of my continued HTB practice and learning in Active Directory and offensive security.

#HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning …

Learn MoreHack The Box: Hercules Machine Walkthrough – Insane Diffucility

The post Hack The Box: Hercules Machine Walkthrough – Insane Diffucility appeared first on Threatninja.net.

Completed another Hack The Box machine, Silentium.

Initial access was achieved by exploiting a password-reset vulnerability in the staging Flowise application, followed by abusing a custom MCP endpoint to obtain a root shell inside the Flowise container. Credentials exposed through the container environment were then used to SSH into the underlying host as ben and retrieve the flag.

For privilege escalation, an internal Gogs instance was discovered through local port forwarding. A malicious symlink was pushed and manipulated through the Gogs API to target /etc/sudoers.d/ben, allowing a passwordless sudo rule to be written and ultimately providing full root access.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #CTF …

Learn MoreHack The Box: Silentium Machine Walkthrough – Easy Difficulity

The post Hack The Box: Silentium Machine Walkthrough – Easy Difficulity appeared first on Threatninja.net.

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability.

The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse.

The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained.

Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup …

Learn MoreHack The Box: Pirate Machine Walkthrough – Hard Difficulity

The post Hack The Box: Pirate Machine Walkthrough – Hard Difficulity appeared first on Threatninja.net.

Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise.

Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag.

Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt.

#HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 …

Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty

The post HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed the Hack The Box "Kobold" machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation.

The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #Docker #VulnerabilityManagement #CVE #EthicalHacking #CybersecurityLearning …

Learn MoreHack The Box: Kobold Machine Walkthrough – Easy Difficulty

The post Hack The Box: Kobold Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

Just wrapped up another Hack The Box machine: Fries (Hard).

TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks.

#HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF …

Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty

The post Hack The Box: Fries Machine Walkthrough – Hard Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec …

Learn MoreHack The Box: Logging Machine Walkthrough – Medium Difficulty

The post Hack The Box: Logging Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Just completed the CCTV machine from Hack The Box!

After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

The post Hack The Box: CCTV machine walkthrough – Easy Difficulty appeared first on Threatninja.net.

Just completed the DevArea machine from Hack The Box!

After exploiting a vulnerable Java SOAP service on port 8080, I gained initial access and discovered Hoverfly running on port 8888. Leveraging CVE-2025-54123, I successfully authenticated and delivered a reverse shell, securing the User flag as the dev_ryan user.

For privilege escalation, I took advantage of a sudo permission on the SysWatch management script. By exploiting a symlink attack in the logging functionality, I was able to read /root/root.txt and capture the Root flag.

Really enjoyed this Medium-difficulty box — great mix of Java deserialization/SOAP, API exploitation, and creative Linux privilege escalation!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #CVE #EthicalHacking …

Learn MoreHack The Box: DevArea Machine Walkthrough – Medium Difficulty

The post Hack The Box: DevArea Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.