https://d3bo.eu/en/writeups/hackthebox/Recent content in HackTheBox on d3boHugo -- gohugo.ioenCopyright (c) 2025 HyasThu, 07 Sep 2023 16:06:50 +0200https://d3bo.eu/en/writeups/hackthebox/unobtainium/Tue, 18 Jun 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/unobtainium/We start by exploiting a prototype pollution vulnerability. Then we leverage a command injection CVE to get a shell in a container. For privilege escalation, we pivot between Kubernetes containers and analyze the secrets of a namespace. Finally, using the permission to create pods, we break out of the container.https://d3bo.eu/en/writeups/hackthebox/ready/Fri, 07 Jun 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/ready/In this machine, we exploit a CVE in GitLab that lets us run commands. For privilege escalation, we escape from a Docker container that has the cap_sys_admin capabilityhttps://d3bo.eu/en/writeups/hackthebox/tabby/Thu, 06 Jun 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/tabby/In this machine, we first exploit a Local File Inclusion (LFI) vulnerability to enumerate the Tomcat users. Then we achieve remote code execution (RCE) by uploading a .war file to Tomcat. For privilege escalation, we extract credentials from a zip file and abuse the lxd group.https://d3bo.eu/en/writeups/hackthebox/schooled/Thu, 28 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/schooled/We exploit an XSS in Moodle to steal a session cookie and a Moodle 3.9 CVE that leads to RCE. For privilege escalation, we become root through the pkg command, due to misconfigured permissions in /etc/sudoershttps://d3bo.eu/en/writeups/hackthebox/october/Wed, 27 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/october/In this machine we exploit OctoberCMS with default credentials and a file upload that bypasses an extension check. For privilege escalation we perform a buffer overflow with a technique called ret2libc, with ASLR (Address Space Layout Randomization) enabledhttps://d3bo.eu/en/writeups/hackthebox/buff/Mon, 18 Mar 2024 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/buff/It is a very simple machine, but we are going to analyze in depth a Buffer Overflow in CloudMe 1.11.2 and an ‘Unauthenticated Remote Code Execution’ in ‘Gym Management System 1.0’https://d3bo.eu/en/writeups/hackthebox/enterprise/Sat, 11 Nov 2023 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/enterprise/In this writeup we solve the Enterprise machine from HackTheBox. It is a very interesting medium machine: we cover WordPress and Joomla web enumeration and SQL injections, escape from a Docker container and finally exploit a very interesting buffer overflow with the ret2libc techniquehttps://d3bo.eu/en/writeups/hackthebox/jupiter/Wed, 01 Nov 2023 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/jupiter/In today’s machine we cover subdomain enumeration and turn a PostgreSQL injection into RCE. For privilege escalation we work with cron jobs, port forwarding and Pythonhttps://d3bo.eu/en/writeups/hackthebox/toolbox/Sun, 29 Oct 2023 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/toolbox/Reconnaissance First of all, we check whether the machine is up and which OS it runs ping -c 1 10.10.10.236 PING 10.https://d3bo.eu/en/writeups/hackthebox/blue/Mon, 13 Mar 2023 00:00:00 +0000https://d3bo.eu/en/writeups/hackthebox/blue/Reconnaissance First of all, we check whether the machine is up and which OS it runs ❯ ping -c 1 10.