HTB Networked — Full Write-up
GIF magic bytes smuggle PHP for the foothold, a cron job with an unsanitized exec() gives the user, and a sudo rule points at a network-scripts CVE for root.
Daniel Vasilescu
HTB Redelegate — Full Write-up
Anonymous FTP leaks a KeePass database, a password spray lands a foothold, and SeEnableDelegationPrivilege sets up a delegation abuse against the DC.
HTB Media — Full Write-up
A hiring form eats a Windows Media Player file and leaks a hash. The upload folder becomes the webroot, and GodPotato gives SYSTEM.
HTB TombWatcher — Full Write-up
A long AD chain: targeted Kerberoasting, a gMSA secret, ACL abuse, reviving a deleted account, and ESC3 to get around a blocked ESC1.
HTB Pov — Full Write-up
ASP.NET ViewState deserialization gets RCE, stored credentials move us to a second user, and SeDebugPrivilege into a SYSTEM process finishes the job.
HTB Administrator — Full Write-up
Assumed breach within an AD domain. GenericAll and ForceChangePassword chain into a Password Safe backup, then targeted Kerberoasting and DCSync to Domain Admin.
HTB Postman — Full Write-up
Unauthenticated Redis writes an SSH key for the foothold, an encrypted backup key gets cracked, and a Webmin RCE hands over root.
HTB Voleur — Full Write-up
An Active Directory lab: targeted Kerberoasting, pivoting with RunasCs, a deleted account brought back to life, and DPAPI vaults, all the way to Domain Admin via pass-the-hash.