File-Upload

TL;DR - Foothold through Tiny File Manager running with default credentials, uploading a PHP web shell. A hidden vhost soc-player.soccer.htb exposes a ticket feature that talks to the backend over a WebSocket, and its id field is blind-SQL-injectable. Bridging the WebSocket through a small local HTTP shim lets sqlmap automate the extraction, leaking the player DB credentials, which are reused for SSH. Root comes from doas allowing player to run dstat, whose external-plugin mechanism loads an attacker-controlled Python module. ...

TL;DR - A Windows box where a video-upload feature lets us smuggle an .asx playlist pointing at a UNC path. When the server processes it, it authenticates to our SMB listener and leaks enox’s NetNTLM hash, which we crack and reuse over SSH for the foothold. For root, the upload handler stores files in a predictable per-user directory, so we abuse a symlink to redirect our shell.php into the XAMPP webroot, get a webshell, drop to a reverse shell, and finally use FullPowers to recover the service account’s full privilege set and land as nt authority\system. ...