Portfolio HTB profile · Writeups

CTF Writeups

Walkthroughs of retired Hack The Box and Proving Grounds machines: enumeration, foothold, privilege escalation. Flags, hashes, and credentials are redacted. 101 boxes.

Hack The Box (36)

HTB Windows
Active
WindowsActiveDirectorySMBGPP
HTB Windows
Acute
WindowsActiveDirectoryPSWARestrictedShell
HTB Linux
Analytics
CVELinuxRCEMetabase
HTB Linux
Bashed
LinuxGobusterphpbashbusybox
HTB Windows
Bounty
WindowsIISUploadBypasswebconfig
HTB Linux
Broker
LinuxCVEApacheActiveMQJenkins
HTB Windows
Buff
WindowsCVEGymManagementSoftwareRCE
HTB Linux
Busqueda
LinuxPythonCMDInjectiongit
HTB Windows
Cascade
WindowsActiveDirectoryRPCLDAP
HTB Linux
Codify
LinuxNodejsvm2sandbox
HTB Linux
CozyHosting
LinuxSpringBootActuatorCMDInjection
HTB Linux
Devvortex
LinuxJoomlaCVEsubdomainenum
HTB Linux
Falafel
LinuxPHPSQLiSQLMap
HTB Windows
Flight
WindowsActiveDirectorysubdomainbruteLFI
HTB Windows
Forest
WindowsActiveDirectoryRPCASREPRoast
HTB Linux
Irked
LinuxIRCUnrealIRCdsteghide
HTB Windows
Jeeves
WindowsJenkinsGroovySMB
HTB Linux
Knife
LinuxphpCVEbackdoor
HTB Windows
Love
WindowsSSRFVotingSystemCVE
HTB Linux
Mentor
LinuxSNMPSNMPBruteapi
HTB Linux
Monitored
LinuxSNMPNagiosXISQLi
HTB Windows
Monteverde
WindowsActiveDirectorySMBpasswordspraying
HTB Linux
Networked
LinuxApachephpUploadBypass
HTB Linux
Pandora
LinuxSNMPcredentialhuntingSSH
HTB Linux
Pilgrimage
LinuxgitCVEImageMagick
HTB Linux
Poison
FreeBSDPHPLFILogPoisoning
HTB Linux
Precious
LinuxCVEpdfkitCMDInjection
HTB Windows
Remote
WindowsNFSUmbracoCVE
HTB Windows
Return
WindowsActiveDirectoryResponderLDAP
HTB Windows
Sauna
WindowsActiveDirectoryLDAPKerbrute
HTB Windows
SecNotes
WindowsIISCSRFXSRF
HTB Windows
ServMon
WindowsFTPAnonymousPathTraversal
HTB Linux
Sunday
LinuxFingerSolarisPasswordSpray
HTB Linux
Tabby
LinuxLFITomcatWAR
HTB Linux
TartarSauce
LinuxWordPressWPScanRFI
HTB Windows
Timelapse
WindowsActiveDirectorySMBPFX

Proving Grounds (65)

PG Windows
Access
WindowsActiveDirectoryKerberoastFileUpload
PG Windows
Algernon
WindowsSmarterMailDotNetDeserializationCVE-2019-7214
PG Linux
Apex
LinuxFileManagerPathTraversalCVE
PG Linux
Astronaut
LinuxGravCMSCVEYAML
PG Windows
AuthBy
WindowsFTPBasicAuthHashCracking
PG Windows
BillyBoss
WindowsNexusCeWLHydra
PG Linux
Boolean
LinuxWebAppAuthBypassMassAssignment
PG Linux
Bratarina
LinuxSMTPOpenSMTPDCVE
PG Linux
BullyBox
LinuxgitGitDumperBoxBilling
PG Linux
Clue
LinuxCassandraWebPathTraversalCVE
PG Linux
Cockpit
LinuxGobusterFeroxBusterSQLi
PG Windows
Craft
WindowsODTMacroExecutionPhishingUpload
PG Windows
DVR4
WindowsDirectoryTraversalCVE-2018-15745WeakEncryption
PG Linux
Exfiltrated
LinuxSubrionCMSCVEFileUpload
PG Linux
ExGhost
LinuxFTPDefaultCredsPCAP
PG Linux
Extplorer
LinuxGobusterDefaultCredsjohn
PG Linux
Fantastic
LinuxGrafanaCVEPathTraversal
PG Linux
Fired
LinuxOpenfireCVERCE
PG Windows
Fish
WindowsGlassFishDirectoryTraversalSynaMan
PG Linux
Flu
LinuxAtlassianConfluenceCVERCE
PG Linux
Hawat
LinuxSourceCodeReviewSQLiDefaultCreds
PG Windows
Heist
WindowsActiveDirectorySSRFNTLMCapture
PG Linux
Hetemit
LinuxPythonRCEWerkzeug
PG Windows
Hokkaido
WindowsActiveDirectoryKerberoastingTargetedKerberoasting
PG Linux
Hunit
LinuxAPIInfoDisclosureCredentialReuse
PG Windows
Hutch
WindowsActiveDirectoryLDAPPasswordInDescription
PG Windows
Internal
WindowsSMBMS09-050srv2sys
PG Windows
Jacko
WindowsH2DatabaseJNIRCE
PG Windows
Kevin
WindowsHPPowerManagerBufferOverflowCVE-2009-2685
PG Linux
LaVita
LinuxLaravelCVE-2021-3129RCE
PG Linux
Law
LinuxhtmLawedRCEBurpSuite
PG Linux
Levram
LinuxGerapyCVE-2021-43857DefaultCreds
PG Linux
Marketing
LinuxGobusterVirtualHostLimeSurvey
PG Windows
MedJed
WindowsWebDAVFTPBarracudaDrive
PG Windows
Mice
WindowsRemoteMouseRCEFileZilla
PG Windows
Monster
WindowsMonstraCMSMD5hashcat
PG Linux
Muddy
LinuxXXESOAPLadon
PG Linux
MZEEAV
LinuxFileUploadMagicBytesSourceCodeReview
PG Windows
Nagoya
WindowsActiveDirectoryPasswordSprayKerberoast
PG Linux
Nibbles
LinuxPostgreSQLRCECVE
PG Windows
Nickel
WindowsHTTPVerbTamperingProcessDumpBase64
PG Linux
Nukem
LinuxWordPressFileUploadCVE
PG Linux
Ochima
LinuxMaltrailRCECVE
PG Linux
PayDay
LinuxCSCartDefaultCredsAuthenticatedRCE
PG Linux
PC
LinuxttydWebTerminalrpc
PG Linux
Pelican
LinuxExhibitorZooKeeperCommandInjection
PG Linux
Peppo
LinuxidentDefaultCredsrbash
PG Linux
PostFish
LinuxSMTPPhishingPOP3
PG Linux
PyLoader
LinuxpyLoadCVE-2023-0297PreAuthRCE
PG Linux
QuackerJack
LinuxrConfigSQLInjectionHashCracking
PG Linux
Readys
LinuxWordPressLFIRedis
PG Windows
Resourced
WindowsActiveDirectoryNullSessionPasswordInDescription
PG Linux
RoqueFort
LinuxGiteaRCECVE
PG Windows
Shenzi
WindowsSMBWordPressNullSession
PG Windows
Slort
WindowsRFIPHPXAMPP
PG Linux
Snookums
LinuxRFILFIPwnKit
PG Linux
Sorcerer
LinuxNFSSSHSCPWrapper
PG Linux
SpiderSociety
LinuxDefaultCredsFTPCredentialHunting
PG Windows
Squid
WindowsSquidProxySSRFphpMyAdmin
PG Linux
Sybarys
LinuxRedisFTPRedisModules
PG Windows
Vault
WindowsActiveDirectorySMBNTLMTheft
PG Linux
Walla
LinuxDefaultCredsRaspAPWebConsole
PG Linux
Wheels
LinuxXPathInjectionAccountTakeoverSUID
PG Linux
XposedAPI
LinuxWAFBypassLFICommandInjection
PG Linux
ZenPhoto
LinuxZenPhotoRCECVE