Htb on kanyo's blog

HTB Season 10: CCTV

Sat, 07 Mar 2026 00:00:00 +0000

CCTV is a Linux Easy box with a network flavor you don’t see as often on Easy rated machines. The surveillance theme is consistent throughout. You’re watching the system, and the system is watching you back. Passive analysis plays a bigger role here than brute force.

What’s Inside

A surveillance software stack with a web interface worth poking around
Network traffic that reveals more than the UI does
A hidden service that only shows up once you’re listening in the right place
A short pivot from that service to a root shell

HTB Season 10 is still active. Full writeup drops once this machine retires.

HTB: MonitorsFour

Mon, 02 Mar 2026 00:00:00 +0000

MonitorsFour is a Hard box and earns it, but not through obscurity. Each step is logical and builds on the last. The Docker escape at the end is the most interesting part, built around a real CVE with a CVSS of 9.3 that was still pretty fresh when this box dropped.

Recon

Web app at monitorsfour.htb. Nothing immediately obvious on the landing page, so I started fuzzing endpoints.

ffuf -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words.txt -u http://monitorsfour.htb/FUZZ

One endpoint stood out: /user. It accepted a token parameter, which immediately looked interesting. The question was what it actually did with that token.

HTB Season 10: Pirate

Sat, 28 Feb 2026 00:00:00 +0000

Pirate is a Windows Hard box and earns the rating. It’s a multi stage Active Directory environment where no single step gets you very far on its own. The path to Domain Admin is built from several smaller wins stacked on top of each other. The kind of machine you want to take notes on.

What’s Inside

A realistic Active Directory environment with multiple users, groups, and services in play
Early enumeration that rewards thoroughness over speed
At least two distinct AD misconfigurations that each open a new door
A final escalation that ties the chain together, satisfying when it clicks

HTB Season 10 is still active. Full writeup drops once this machine retires.

HTB Season 10: Interpreter

Sat, 21 Feb 2026 00:00:00 +0000

Interpreter is a Linux Medium that puts a healthcare integration platform in the spotlight. The domain context adds some flavor. Think HL7, FHIR adjacent tooling, the kind of software that runs hospitals and rarely sees a pentest. Getting in is one thing; what happens after is the more memorable part.

What’s Inside

A web facing integration platform with an exploitable component
Enough context clues in the app to understand what you’re targeting
A foothold that requires reading the application’s behavior carefully
A privilege escalation involving code execution in an unexpected context. This one sticks with you

HTB Season 10 is still active. Full writeup drops once this machine retires.

HTB: Expressway

Fri, 20 Feb 2026 00:00:00 +0000

Expressway is the kind of machine that makes you second-guess your recon. You scan it, get one TCP port, and think you must have missed something. You didn’t. There’s no web app here, no API, no admin panel to poke at. Just SSH and a VPN service sitting on UDP that most people walk right past.

Recon

TCP scan first, as always.

nmap -sV -O MACHINE_IP -T5

PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 10.0p2 Debian 8 (protocol 2.0)

One result: port 22, OpenSSH 10.0. That’s it. At this point you either assume the box is broken or you scan UDP.

HTB Season 10: WingData

Sat, 14 Feb 2026 00:00:00 +0000

WingData is a Linux Easy box that keeps things straightforward. Exposed service, weak credentials, misconfigured sudo. It’s the kind of machine that teaches good enumeration habits more than anything else.

What’s Inside

An FTP service running a version worth looking up
Credentials that need a bit of offline work to crack
A foothold that requires patience more than cleverness
A sudo misconfiguration that closes things out quickly once you’re in

HTB Season 10 is still active. Full writeup drops once this machine retires.

HTB: Conversor

Fri, 13 Feb 2026 00:00:00 +0000

Conversor is a Linux Medium that gives you the source code upfront. That’s not a gift so much as a heads up. You’re expected to actually read it. The machine is built around a file conversion web app, and the foothold hinges on understanding what the app does under the hood before you can abuse it.

Recon

Standard nmap scan. Two ports open, everything else closed or filtered.

┌──(kanyo㉿GIGABYTE)-[~]
└─$ nmap -T4 -sV -sC 10.129.238.31
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-13 14:12 +0100
Nmap scan report for 10.129.238.31
Host is up (0.15s latency).
Not shown: 993 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 01:74:26:39:47:bc:6a:e2:cb:12:8b:71:84:9c:f8:5a (ECDSA)
|_ 256 3a:16:90:dc:74:d8:e3:c4:51:36:e2:08:06:26:17:ee (ED25519)
80/tcp open http Apache httpd 2.4.52
|_http-server-header: Apache/2.4.52 (Ubuntu)
|_http-title: Did not follow redirect to http://conversor.htb/
1083/tcp filtered ansoft-lm-1
2260/tcp filtered apc-2260
3918/tcp filtered pktcablemmcops
5718/tcp filtered dpm
7025/tcp filtered vmsvc-2
Service Info: Host: conversor.htb; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Port 80 redirects to conversor.htb, so add that to /etc/hosts and move on. The web app is a file converter: you upload something, it spits back a transformed version. There’s a file upload input on the main page. That’s your surface right there.

HTB Season 10: Pterodactyl

Sat, 07 Feb 2026 00:00:00 +0000

Pterodactyl is a Linux Medium that puts a popular open source game server panel front and center. If you’ve ever set up a Minecraft or game hosting environment, the interface will feel familiar, which makes spotting what’s wrong with it a bit more satisfying.

What’s Inside

A known vulnerability in a widely deployed panel. Enumeration pays off here
Database access as a stepping stone, not the final goal
Credential reuse across services (classic, but it works)
A privilege escalation that builds naturally on what you already have

HTB Season 10 is still active. Full writeup drops once this machine retires.

HTB Season 10: Facts

Sat, 31 Jan 2026 00:00:00 +0000

Facts is a Linux Easy box with a clean, grounded feel. The kind of machine where the attack surface is right in front of you if you bother to look carefully at the web app.

What’s Inside

A content management system doing more than it should be
Some cloud storage integration that leaks more than intended
Credentials hiding in places people forget to clean up
A privilege escalation that’s more creative than your typical SUID hunt

HTB Season 10 is still active. Full writeup drops once this machine retires.