Completed another Hack The Box machine focused on Active Directory exploitation and privilege escalation.

The attack involved SMB enumeration, credential discovery through log analysis, Kerberos authentication, Shadow Credentials abuse, and DLL hijacking to gain user-level access. Further enumeration revealed a WSUS infrastructure weakness, allowing exploitation through Kerberos delegation abuse, certificate-based authentication, and a WSUS machine-in-the-middle attack to achieve Domain Admin privileges. This challenge strengthened my understanding of modern AD attack paths, Kerberos abuse techniques, and enterprise infrastructure security.

#HackTheBox #HTB #CyberSecurity #ActiveDirectory #RedTeam #PenetrationTesting #OffensiveSecurity #EthicalHacking #InfoSec …

Learn MoreHack The Box: Logging Machine Walkthrough – Medium Difficulty

The post Hack The Box: Logging Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Just completed the CCTV machine from Hack The Box!

After enumerating the target, I discovered a ZoneMinder instance exposed on the web interface. Using the default administrative credentials, I gained access to the application and identified a SQL injection vulnerability in the removetag endpoint. By leveraging SQLMap, I extracted the database contents and recovered valid credentials through bcrypt hash cracking with Hashcat, allowing SSH access as the mark user and securing the User flag.

For privilege escalation, I discovered a locally running MotionEye service and extracted authentication details from its configuration files. After accessing the internal web interface through SSH port forwarding, I exploited a command injection vulnerability in the image filename configuration to obtain a root shell and capture the Root flag.

Really enjoyed this Easy-difficulty box — a great combination of web application exploitation, SQL injection, credential recovery, and Linux privilege escalation techniques!

#HackTheBox #HTB #PenetrationTesting #CyberSecurity #PrivilegeEscalation #SQLInjection #EthicalHacking #Linux #OffensiveSecurity …

Learn MoreHack The Box: CCTV machine walkthrough – Easy Difficulty

The post Hack The Box: CCTV machine walkthrough – Easy Difficulty appeared first on Threatninja.net.

If you want to get around Monaco, a map — digital or otherwise — is probably the best way to navigate. But if you just want to appreciate the city’s form in a more artistic way, you might enjoy [Terence Grover’s] latest project—a backlit topographic map of the unique principality.

The project started with a QGIS mesh of Monaco, with the data fed through the Open-Meteo elevation API, which takes into account building heights. This was used as the basis for the heights of 179 pieces of 20 mm x 20 mm acrylic. These were assembled into a laser cut steel base, and were sanded on all sides but the base in order to allow them to diffuse light more effectively.

Strips of CS8812 LEDs are used to light the plastic towers, driven by a pair of Adafruit Feather RP2040 Scorpio boards. They’re fed pixel data from a Raspberry Pi 5, which runs a Flask panel accessed over an iPad. This allows control over the LED map display, showing things like civic data, highlighted events, and weather. There’s even a touch-sensitive mode that lets one paint fun patterns across the representation of the city.

We love a good artistic map, particularly when they’re full of LEDs and represent useful information.