HackTheBox

Unobtainium

We start by exploiting a prototype pollution vulnerability. Then we leverage a command injection CVE to get a shell in a container. For privilege escalation, we pivot between Kubernetes containers and analyze the secrets of a namespace. Finally, using the permission to create pods, we break out of the container.

June 18, 202417 minutes

Ready

In this machine, we exploit a CVE in GitLab that lets us run commands. For privilege escalation, we escape from a Docker container that has the cap_sys_admin capability

June 7, 20245 minutes

Tabby

In this machine, we first exploit a Local File Inclusion (LFI) vulnerability to enumerate the Tomcat users. Then we achieve remote code execution (RCE) by uploading a .war file to Tomcat. For privilege escalation, we extract credentials from a zip file and abuse the lxd group.

June 6, 20248 minutes

Schooled

We exploit an XSS in Moodle to steal a session cookie and a Moodle 3.9 CVE that leads to RCE. For privilege escalation, we become root through the pkg command, due to misconfigured permissions in /etc/sudoers

March 28, 20248 minutes

October

In this machine we exploit OctoberCMS with default credentials and a file upload that bypasses an extension check. For privilege escalation we perform a buffer overflow with a technique called ret2libc, with ASLR (Address Space Layout Randomization) enabled

March 27, 202410 minutes

Buff

It is a very simple machine, but we are going to analyze in depth a Buffer Overflow in CloudMe 1.11.2 and an 'Unauthenticated Remote Code Execution' in 'Gym Management System 1.0'

March 18, 202420 minutes

Enterprise

In this writeup we solve the Enterprise machine from HackTheBox. It is a very interesting medium machine: we cover WordPress and Joomla web enumeration and SQL injections, escape from a Docker container and finally exploit a very interesting buffer overflow with the ret2libc technique

November 11, 202327 minutes