Writeups

HTB VulnCicada machine avatar

HTB: VulnCicada

· 8 min read
Windows Medium

A Medium Windows AD box where an NFS share leaks a password from a photo, and NTLM being disabled domain-wide turns a standard ESC8 web enrollment relay into a Kerberos relay via DNS SPN spoofing. A DC machine certificate, PKINIT, and secretsdump close it out.

esc8krbrelaynfs +2
HTB Jeeves machine avatar

HTB: Jeeves

· 5 min read
Windows Medium

A Medium Windows box where a fake Ask Jeeves search page on port 80 hides an unauthenticated Jenkins instance on port 50000. The Groovy script console gives code execution, a KeePass database yields an NTLM hash for pass-the-hash as Administrator, and the root flag is hidden in an NTFS alternate data stream.

keepassjenkinswindows
HTB Media machine avatar

HTB: Media

· 4 min read
Windows Medium

A Medium Windows box where uploading a malicious .m3u file coerces an NTLMv2 hash from the server via Windows Media Player's automatic UNC path fetching. A junction symlink redirects uploads into the webroot for a Local Service shell, and SeTcbPrivilege closes it out.

tcbsymlinkwindows
HTB Postman machine avatar

HTB: Postman

· 3 min read
Linux Easy

An Easy Linux box where unauthenticated Redis lets you inject an SSH key for a foothold. A cracked SSH key backup from /opt turns out to be Matt's Webmin password, and CVE-2019-15642 on Webmin 1.910 turns that authenticated session into a root shell.

webminredislinux
HTB Trick machine avatar

HTB: Trick

· 5 min read
Linux Easy

An Easy Linux box that chains a DNS zone transfer into a time-based blind SQLi, then pivots to a second preprod subdomain where unfiltered LFI gives michael's SSH key. The privilege escalation abuses write access to fail2ban's action configs and a NOPASSWD restart to plant a SUID shell.

fail2banlfisqli +1
HTB Pov machine avatar

HTB: Pov

· 5 min read
Windows Medium

A Medium Windows box where an LFI in a dev subdomain's CV download feature leaks the ASP.NET machineKey. Forging a malicious ViewState gets code execution, and SeDebugPrivilege with parent PID spoofing closes it out.

ppidaspnetrunas +1
HTB Voleur machine avatar

HTB: Voleur

· 7 min read
Windows Medium

A Medium Windows box where NTLM is fully disabled and a leaked spreadsheet in an SMB share hands you passwords for accounts you can't yet reach. The chain runs through targeted kerberoasting, tombstone reanimation, and DPAPI blobs left in a deleted user's archived profile.

ntlm-disableddpapireanimate-tombstone +2
HTB Fluffy machine avatar

HTB: Fluffy

· 7 min read
Windows Easy

An Easy Windows box where CVE-2025-24071 coerces an NTLMv2 hash via a malicious .library-ms file. Shadow Credentials get lateral movement into WinRM, and ESC16 issues a domain admin cert.

esc16kerberosadcs +2
HTB TombWatcher machine avatar

HTB: TombWatcher

· 6 min read
Windows Medium

A Medium Windows box where a BloodHound ACL chain reaches john, Reanimate-Tombstones restores a deleted cert_admin into an OU where you have GenericAll, and ESC15 issues a domain admin cert via LDAPS Schannel.

esc15acl-abuseinheritance +2
HTB Pandora machine avatar

HTB: Pandora

· 6 min read
Linux Easy

An Easy Linux box where SNMP with the default community string leaks SSH creds from process arguments. An unauthenticated SQLi on Pandora FMS hijacks a session for RCE, and a SUID PATH hijack closes it.

path-hijacksqlicve-exploit +2
HTB StreamIO machine avatar

HTB: StreamIO

· 6 min read
Windows Medium

A Medium Windows box that chains SQL injection on a hidden subdomain through PHP eval RCE to a LAPS read. Firefox saved passwords and JDgodd's group ownership are the two pivots.

lapsps-remotingsqli +2
HTB Administrator machine avatar

HTB: Administrator

· 5 min read
Windows Medium

A Medium box built around a BloodHound ACL chain with starting credentials. Three password resets walk you down to a Password Safe on FTP, and a fake SPN plus targeted Kerberoasting gets DCSync at the end.

acl-abusepsafewindows
HTB Authority machine avatar

HTB: Authority

· 6 min read
Windows Medium

A Medium Windows box where cracking Ansible Vault files on a public share leads to a PWM portal. Redirecting its LDAP config to Responder gets cleartext creds, and ESC1 via LDAPS Schannel gets Domain Admin.

pwmadcswindows
HTB Escape machine avatar

HTB: Escape

· 3 min read
Windows Medium

A Medium Windows box where a PDF on a public SMB share leaks MSSQL guest credentials. NTLM coercion via xp_dirtree cracks sql_svc, a mistyped login leaks Ryan.Cooper's password, and ESC1 finishes it.

mssqladcswindows
HTB Scrambled machine avatar

HTB: Scrambled

· 5 min read
Windows Medium

A Medium Windows box where NTLM is disabled domain-wide, forcing pure Kerberos. Kerberoasting yields sqlsvc, a silver ticket forged from its NT hash bypasses MSSQL access restrictions, and GodPotato closes it.

forge-silver-ticketkerberosmssql +1
HTB Cicada machine avatar

HTB: Cicada

· 3 min read
Windows Easy

An Easy Windows box where one default password in an HR share starts a credential chain. An AD description field and a backup script leak two more accounts, and Backup Operators with SeBackupPrivilege gets Domain Admin.

vssnxcwindows
HTB EscapeTwo machine avatar

HTB: EscapeTwo

· 4 min read
Windows Easy

An Easy Windows box that starts with given credentials. A spreadsheet on an SMB share leaks the MSSQL sa password, a config file exposes ryan's, and WriteOwner over ca_svc chains ESC4 into ESC1.

adcsmssqlwindows
HTB Return machine avatar

HTB: Return

· 3 min read
Windows Easy

An Easy Windows box where the printer admin panel's LDAP settings page leaks svc-printer's credentials to a netcat listener. Server Operators membership and a service binary hijack get SYSTEM.

server-operatorswindows
HTB Sauna machine avatar

HTB: Sauna

· 4 min read
Windows Easy

An Easy Windows box where employee names on the bank website generate username variants for AS-REP roasting. Winlogon autologon keys hand over svc_loanmgr, who has DCSync rights over the domain.

user-anarchywindows
HTB Timelapse machine avatar

HTB: Timelapse

· 3 min read
Windows Easy

An Easy Windows box where cracking a PFX from a guest-readable SMB share authenticates to WinRM via client certificate. PowerShell history leaks svc_deploy's credentials, and LAPS gives the DC admin password.

lapswindows

HackINI 2026: Corp Monitor

· 3 min read

Medium Linux box. Anonymous FTP for recon, Drupalgeddon2 for the shell, then Grafana 8.2.6 path traversal reads root's SSH key. Credential harvest from the Drupal DB feeds the rest of the chain.

drupalcve-2018-7600grafana +4

HackINI 2026: IT Workstation

· 3 min read

Medium Windows box. WinRM entry with harvested credentials, Autologon registry keys expose the local Administrator password in plaintext, and Mimikatz pulls a domain credential from Credential Manager.

windowsmimikatzcredential-manager +2

HackINI 2026: Legacy

· 4 min read

Medium Linux box. Exposed .git directory identifies Anuko Time Tracker 1.20, exploited via CVE-2022-24707 SQL injection in the puncher plugin. Webmin on port 10000 hands over root through credential reuse.

linuxanukosqli +2

HackINI 2026: Shell-DC

· 6 min read

Hard Active Directory box. Kerberoasting, BloodHound ACL abuse, Shadow Credentials, gMSA password extraction, tombstone reanimation, and pcap NTLM cracking chain to Domain Admin.

active-directorykerberoastingshadow-credentials +4

IngeHack: EDR Evasion

· 1 min read

An Active Directory series from IngeHack. First challenge: bypassing Windows Defender to get tooling onto the machine. The rest of the chain is in progress.

windowsactive-directoryedr-evasion +2

HTB Season 10: CCTV

· 1 min read
Linux Easy

A Linux Easy machine themed around surveillance software. Getting to root means sniffing traffic and finding a service that wasn't meant to be found.

htbseason-10linux

HTB: MonitorsFour

· 5 min read
Linux Hard

A Hard Linux box that chains an unauthenticated API leak, Cacti RCE, and a CVE-2025-9074 Docker Desktop escape to reach the host filesystem. The container escape is the highlight.

htblinuxcontainer-escape

HTB Season 10: Pirate

· 1 min read
Windows Hard

A Windows Hard machine with a full Active Directory environment. This one's a long haul, multiple misconfigurations chained together across a realistic AD setup.

htbseason-10windows

HTB Season 10: Interpreter

· 1 min read
Linux Medium

A Linux Medium built around a healthcare integration platform. The exploit path is interesting, but the privesc is what makes this machine worth remembering.

htbseason-10linux

HTB: Expressway

· 4 min read
Linux Medium

A Linux Medium with no web surface at all. The whole foothold runs through a VPN service on UDP 500, IKE aggressive mode leaks an identity, and a cracked PSK gets you in.

htblinuxvpn

HTB Season 10: WingData

· 1 min read
Linux Easy

A Linux Easy machine with an exposed FTP service, some credential work, and a sudo misconfiguration that makes the privesc almost too clean.

htbseason-10linux

HTB: Conversor

· 4 min read
Linux Medium

A Linux Medium built around a file conversion web app. XSLT injection lets you write files to a cron-watched directory, and a vulnerable needrestart version gets you to root.

htblinuxcron

HTB Season 10: Pterodactyl

· 1 min read
Linux Medium

A Linux Medium built around a game server management panel. Exploitation leads through database access all the way to root, with a couple of interesting hops in between.

htbseason-10linux

HTB Season 10: Facts

· 1 min read
Linux Easy

A Linux Easy machine centered around a CMS-backed web app, some cloud storage interaction, and a satisfying privesc to cap it off.

htbseason-10linux