Posts

Description Checkpoint is a medium-difficulty Active Directory (AD) environment machine hosted on Hack The Box. Key vulnerabilities and discovery paths found in this machine include: Vulnerable SMB shares (DevDrop, VMBackups) Malicious Visual Studio Code Extension Remote Command Execution Directory Service Management Account (dMSA) vulnerabilities (BadSuccessor) Lateral movement via Kerberos ticket harvesting (TGS delegation) Credential harvesting from memory dumps (Volatility) Domain secret extraction (NTDS.DIT) Footprinting The initial phase of reconnaissance focused on gathering basic network information regarding the target IP address, 10.129.16.242. A basic ping utility was executed to assess network reachability and analyze the Time To Live (TTL) value. ...

Description DevHub is rated as a medium-difficulty target from Hack The Box. The following key vulnerabilities and architectural flaws were systematically identified within the target environment: Remote Code Execution (RCE) vulnerability in the MCPJam Inspector application (CVE-2026-23744) Insecure exposure of an Analytics Dashboard (Jupyter Notebook), allowing authentication via a statically visible token Presence of a custom Flask application (OPSMCP) exhibiting critical secret exposure via hardcoded API keys A severe logic and access control flaw within OPSMCP, enabling the spawn of a root shell Footprinting The initial reconnaissance phase focused on establishing basic connectivity and performing network analysis to profile the target system (10.129.1.237). We utilized the ping utility to confirm host responsiveness and analyze the Time To Live (TTL). ...

Description Reactor is classified as an easy difficulty machine in Hack The Box. Key vulnerabilities and steps identified in this machine include: Initial web application vulnerability (NextJS) allowing for potential Remote Code Execution (RCE) Database compromise leading to user credential hashes A low-privileged user account with access to internal systems A critical Node.js debugging endpoint running with elevated privileges (Root), enabling privilege escalation Footprinting The initial phase of reconnaissance is paramount in understanding the target’s architecture and operational status. By performing a simple ping scan on the target IP, 10.129.1.23, we can gather preliminary information about the operating system. ...

Description SmartHire is a challenging medium-difficulty machine on Hack The Box and presents a modern attack surface centered around a machine learning pipeline. The key vulnerabilities and attack vectors discovered during this engagement include: Vulnerability in the primary web application’s ML training process Exposure of a subordinate MLflow service on a subdomain Remote Code Execution (RCE) vulnerability (CVE-2024-37054) in MLflow Critical privilege escalation vulnerability via Python Path Hijacking in a utility script Footprinting The reconnaissance phase begins by identifying the target system’s operating system and available services. We first utilize the ping command to confirm the host is reachable and to analyze the Time To Live (TTL) value, which provides initial hints about the host OS architecture. ...

Description Silentium is an easy Hack The Box machine that features: Subdomain Enumeration to discover Flowise web application Flowise Unauthenticated Password Reset and Account Takeover Flowise Authenticated Remote Command Execution leads to a Docker container Reused Linux credentials from a Docker container environment variables Privilege Escalation via Command Execution in Gogs with a Git hook Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.32.14. ...

Introduction In the current cybersecurity landscape, the attack surface of mobile applications and their backend services has expanded exponentially. Applications, especially those that handle sensitive information such as health data, become critical entry points for attackers seeking to exploit weaknesses in the authentication layer, data integrity, or access control. This analysis focuses on the interception and exhaustive study of communications from a mobile pulse oximeter application through a network proxy. ...

Description Helix is a medium Hack The Box machine that features: Subdomain Enumeration to find an Apache NiFi web application Remote Command Execution in NiFi via a H2 driver User Pivoting via a backup SSH private key Privilege Escalation via an OPC UA server variable writing to enter into maintenance mode and spawn a root shell Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.48.7. ...

Description Kobold is an easy Hack The Box machine that features: Subdomain Enumeration to find a MCPJam Inspector instance MCPJam Inspector Remote Command Execution to get a Linux Shell Privilege Escalation by pivoting to docker group using a SUID newgrp command and the ability to mount /root folder Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.15.112. ...

Introduction This article focuses on the exhaustive analysis of the communication layer of an Android mobile application for a smartwatch through network traffic interception and the manipulation of authentication and data flows. The relevance of this analysis lies in the detection of critical vulnerabilities that, while they may seem like minor implementation flaws, represent severe operational risks. The identified attack vectors range from failures in session and credential management (such as the absence of anti-brute force mechanisms) to deficiencies in business logic and data management, allowing unauthorized access to third-party information. ...

Description Logging is a medium Hack The Box machine that features: Active Directory initial reconnaissance via an assumed breach scenario SMB Enumeration leads to the discovery of credentials in a log saved in a shared folder User Pivoting via the GenericWrite permissions and the Shadow Credentials attack, allowing to have remote permission to the machine User Pivoting by using DLL Hijacking technique over a service executed by another user Privilege Escalation with a rogue WSUS server and malicious updates, with the injection of DNS values and the generation of a TLS certificate trusted by the domain Footprinting First, we are going to check with ping command if the machine is active and the system operating system. The target machine IP address is 10.129.40.79. ...