HTB: Trick

Mon, 08 Jun 2026 00:00:00 +0000

An Easy box but one that makes you work for it in an unexpected direction. Port 80 is a static placeholder page with nothing on it. The real surface is DNS: zone transfer hands you a subdomain, that subdomain has a login form with a time-based blind SQLi, you get credentials, but the LFI on that same app is filtered. The actual LFI is on a second subdomain you only find by fuzzing a prefix pattern. That subdomain reads michael’s SSH key, you get in, and the privilege escalation is a clean abuse of fail2ban’s action config combined with sudo restart rights. The credentials from payroll end up being almost irrelevant to the root path, which is a bit annoying in hindsight, but the DNS zone transfer and the fail2ban trick are both things worth keeping in your toolkit.

Lfi on kanyo's blog

HTB: Trick