June 2026
10 writeupsHTB: Ghost
Insane Windows box. LDAP injection to foothold, SSH ControlMaster hijack to steal a Kerberos ticket, Golden SAML via ADFS private keys, and a cross-forest Golden Ticket to take …
HTB: Flight
Hard Windows box where UNC coercion is the whole story. PHP's file functions hand UNC paths straight to the Windows API, so the LFI param is really a credential stealer. Then …
HTB: VulnCicada
A Medium Windows AD box where an NFS share leaks a password from a photo, and NTLM being disabled domain-wide turns a standard ESC8 web enrollment relay into a Kerberos relay via …
HTB: Trick
An Easy Linux box that chains a DNS zone transfer into a time-based blind SQLi, then pivots to a second preprod subdomain where unfiltered LFI gives michael's SSH key. The …
HTB: Postman
An Easy Linux box where unauthenticated Redis lets you inject an SSH key for a foothold. A cracked SSH key backup from /opt turns out to be Matt's Webmin password, and …
HTB: Media
A Medium Windows box where uploading a malicious .m3u file coerces an NTLMv2 hash from the server via Windows Media Player's automatic UNC path fetching. A junction symlink …
HTB: Jeeves
A Medium Windows box where a fake Ask Jeeves search page on port 80 hides an unauthenticated Jenkins instance on port 50000. The Groovy script console gives code execution, a …
HTB: Voleur
A Medium Windows box where NTLM is fully disabled and a leaked spreadsheet in an SMB share hands you passwords for accounts you can't yet reach. The chain runs through targeted …
HTB: Pov
A Medium Windows box where an LFI in a dev subdomain's CV download feature leaks the ASP.NET machineKey. Forging a malicious ViewState gets code execution, and SeDebugPrivilege …
HTB: Fluffy
An Easy Windows box where CVE-2025-24071 coerces an NTLMv2 hash via a malicious .library-ms file. Shadow Credentials get lateral movement into WinRM, and ESC16 issues a domain …