HackTheBox

TL;DR - A brewery site points at a Gogs instance and a REST API. A public commit on Gogs leaks dinesh’s creds, and digging through the API code I find an eval() on the abv parameter of the /brew endpoint. I abuse it with a little python script for a reverse shell, landing inside a Docker container. The DB config there leaks MySQL creds, the user table hands me gilfoyle, and his repo has an id_rsa that logs me into the actual host over SSH (user.txt). For root, gilfoyle manages HashiCorp Vault, and there’s an SSH OTP role called root_otp, so I just ask Vault for a one-time password and SSH straight in as root. ...

TL;DR - An assumed-breach, Kerberos-only box starting with ryan.naylor:HollowOct31Nyt. A share holds a password-protected Access_Review.xlsx, cracked with John, which leaks cleartext creds for svc_ldap and svc_iis. BloodHound shows svc_ldap has WriteSPN over svc_winrm, so I add an SPN and kerberoast it, crack the hash, and get a WinRM shell (user.txt). svc_ldap is in restore_users, so I restore the deleted user todd.wolfe from the AD Recycle Bin, decrypt his DPAPI-protected credentials to get jeremy.combs, use a leaked SSH key to log in as svc_backup, and from there grab ntds.dit + SYSTEM, dump the hashes, and pass-the-key as Administrator for root.txt. ...

TL;DR - A long one. A boolean LDAP injection on the intranet lets me log in as kathryn.holland with */*, then brute-force the password of gitea_temp_principal. Inside Gitea the Ghost CMS repo has a path traversal that reads /proc/self/environ for the DEV_INTRANET_KEY, and the dev API behind that key has a command injection, which gives me a shell in a Linux container running as root. Its env leaks intranet_principal, a real domain account. From there it is all AD: kerberoast adfs_gmsa, grab a cached Kerberos ticket for florence.ramirez, coerce justin.bradley with a fake DNS record plus Responder and crack his hash (user.txt). justin can read the adfs_gmsa gMSA password, so I forge a Golden SAML to log into the ADFS-protected MSSQL console, pivot through a linked server to PRIMARY, impersonate sa for RCE, abuse SeImpersonate to get SYSTEM on corp.ghost.htb, and finally forge a cross-domain Golden Ticket to own ghost.htb and grab root.txt. ...

TL;DR - A WordPress site vulnerable to CVE-2022-0739 (a BookingPress SQL injection) dumps the manager and admin hashes. Cracking manager gives partylikearockstar and a wp-admin login. From there, CVE-2021-29447 (a WordPress media XXE) lets me read files off the box, including wp-config.php, which has the DB and FTP creds inside. On the FTP share there’s a send_email.php with jnelson’s password in plaintext, and that same password works over SSH (user.txt). For root, a hidden .passpie keyring holds GPG keys, so I crack the passphrase with John, unlock passpie, and export the vault to get the root password (root.txt). ...

TL;DR — Port 8443 runs PWM, a self-service password portal, and SMB allows anonymous/guest access. That guest read on the Development share exposes Ansible automation whose PWM role holds ansible-vault encrypted secrets. Cracking the vault (ansible2john + john) and decrypting it gives the PWM admin svc_pwm:pWm_@dm!N_!23. Inside PWM I point the LDAP profile at a rogue server (plain ldap://389) and Responder captures svc_ldap:lDaP_1n_th3_cle4r! in cleartext — a WinRM user (user.txt). Finally, ADCS (the CorpVPN / ESC1 template) plus an LDAP shell adding my user to Domain Admins lands Administrator and root.txt. ...

TL;DR - A support site runs osTicket and a Mattermost chat server. Creating a ticket hands us a temporary @delivery.htb email, which we use to register and self-validate a Mattermost account, because the validation link lands back in our own ticket. Inside Mattermost, a team channel leaks SSH credentials (maildeliverer) for the foothold. Root comes from the Mattermost DB config, which holds MySQL creds, where the root user’s hash lives, cracked with a hashcat ruleset applied to a password hint found in the same chat. ...

TL;DR - An exposed NFS share (/site_backups) mounts without authentication and contains an Umbraco CMS backup. The admin password hash lives in Umbraco.sdf; cracking it with rockyou gives CMS login. Umbraco 7.12.4 is vulnerable to authenticated RCE, which we use to stage nc.exe and pop a reverse shell. The service account holds SeImpersonatePrivilege, so PrintSpoofer escalates straight to nt authority\system. Recon Starting this machine with a full nmap scan. ...

TL;DR - A Domain Controller exposing a Replication share over anonymous SMB leaks a Groups.xml containing a GPP-encrypted password. Microsoft published the AES key for GPP, so it decrypts offline to the svc_tgs credentials, which open the Users share and user.txt. The Administrator account has an SPN registered, so a Kerberoast against it yields a TGS hash that cracks with rockyou, giving full domain compromise. Recon Starting with a full nmap scan on the host and saving the results to a file: ...

TL;DR - An assumed-breach Active Directory box starting with Olivia:ichliebedich. BloodHound maps an ACL chain: Olivia has GenericAll over Michael, Michael can ForceChangePassword on Benjamin, and Benjamin (in Share Moderators) can reach an FTP backup. That backup is a Password Safe vault, cracked to reveal mid-chain users, one of whom (Emily) has GenericWrite over Ethan. A targeted Kerberoast against Ethan cracks his password, and Ethan holds DCSync rights, so secretsdump dumps every hash and a pass-the-hash as Administrator finishes the box. ...

TL;DR - Foothold through Tiny File Manager running with default credentials, uploading a PHP web shell. A hidden vhost soc-player.soccer.htb exposes a ticket feature that talks to the backend over a WebSocket, and its id field is blind-SQL-injectable. Bridging the WebSocket through a small local HTTP shim lets sqlmap automate the extraction, leaking the player DB credentials, which are reused for SSH. Root comes from doas allowing player to run dstat, whose external-plugin mechanism loads an attacker-controlled Python module. ...