Hack The Box
Write-ups, exploits, and notes for all the retired machines I’ve rooted.
Progress on the platform
Hacker
This is where I collect my Hack The Box write-ups. Each post details what I did to gain user and root access, including the tools, commands, and CVEs I used along the way.
The focus is on Active Directory chaining, Linux privilege escalation, and modern web exploitation,... - the skills that really matter in real-world penetration tests.
All write-ups are for retired machines, in accordance with the HackTheBox Terms of Service.
What you'll find here
Latest writeups
Web enumeration leading to config disclosure, credential reuse for SSH access, and sudo misconfiguration for root escalation.
Exposed service RCE for initial foothold, credential harvesting for lateral movement, and SUID binary abuse for privilege escalation to root.
AD enumeration via BloodHound, Timeroasting for machine account compromise, Helpdesk delegation abuse for privilege escalation, and RBCD-based domain admin impersonation.