Hands-on security research, sanitized bug bounty findings and Hack The Box write-ups by Ilias Georgopoulos.https://ilias1988.me/en-ushttps://ilias1988.me/writeups/hackthebox/machines/timelapse/https://ilias1988.me/writeups/hackthebox/machines/timelapse/Timelapse exposes a guest-readable SMB backup; cracking its ZIP and PFX enables certificate WinRM, while PowerShell history and LAPS lead to Administrator.Sun, 04 Oct 2026 00:00:00 GMTactive-directorysmbpassword-crackingpfxcertificate-authenticationwinrmpowershell-historylapsprivilege-escalationhttps://ilias1988.me/writeups/hackthebox/pro-labs/poo/https://ilias1988.me/writeups/hackthebox/pro-labs/poo/P.O.O. chains exposed IIS metadata, an MSSQL linked-server trust loop, IPv6 WinRM and Kerberoasting into full Active Directory compromise.Sat, 03 Oct 2026 00:00:00 GMTactive-directoryiisds-storemssqllinked-serversipv6winrmkerberoastinglateral-movementhttps://ilias1988.me/writeups/hackthebox/machines/knife/https://ilias1988.me/writeups/hackthebox/machines/knife/Knife exposes a backdoored PHP 8.1.0-dev runtime through HTTP; a crafted header gives a james shell, and sudo access to Chef knife leads to root.Fri, 02 Oct 2026 00:00:00 GMTphpsupply-chainremote-code-executionreverse-shellsudoprivilege-escalationhttps://ilias1988.me/writeups/hackthebox/machines/remote/https://ilias1988.me/writeups/hackthebox/machines/remote/Remote exposes an NFS backup with Umbraco credentials; authenticated CMS RCE yields an IIS shell, and TeamViewer password reuse leads to SYSTEM.Thu, 01 Oct 2026 00:00:00 GMTnfsumbracopassword-crackingauthenticated-rcepowershellteamviewercredential-reuseprivilege-escalationhttps://ilias1988.me/writeups/hackthebox/machines/metatwo/https://ilias1988.me/writeups/hackthebox/machines/metatwo/MetaTwo chains BookingPress SQL injection, WordPress Media Library XXE, exposed FTP and SSH credentials, and Passpie key cracking to reach root.Wed, 23 Sep 2026 00:00:00 GMTwordpressbookingpresssql-injectionpassword-crackingxxeftpsshpasspieprivilege-escalationhttps://ilias1988.me/writeups/hackthebox/challenges/hardware/intrusion/https://ilias1988.me/writeups/hackthebox/challenges/hardware/intrusion/Modbus/TCP write acknowledgements expose a sparse register map, enabling an unauthenticated client to recover sensitive data with targeted reads.Tue, 22 Sep 2026 00:00:00 GMTics-securityot-securitymodbus-tcppacket-analysisregister-enumerationinformation-disclosurepythonhttps://ilias1988.me/bug-bounty/authenticated-smtp-private-network-oracle/https://ilias1988.me/bug-bounty/authenticated-smtp-private-network-oracle/A sanitized report showing how an authenticated SMTP test feature exposed loopback and RFC1918 connection states through timing and error-class differences.Mon, 21 Sep 2026 09:20:00 GMTBug BountySMTPBlind SSRFLoopbackRFC1918https://ilias1988.me/bug-bounty/dns-resolved-private-address-ssrf/https://ilias1988.me/bug-bounty/dns-resolved-private-address-ssrf/A controlled callback and timing analysis showed that a hostname resolving to RFC1918 space reached a backend fetch stage, with impact limited to blind reconnaissance.Mon, 21 Sep 2026 09:10:00 GMTBug BountySSRFDNS ResolutionJWKSEgress Validationhttps://ilias1988.me/bug-bounty/authenticated-connection-validation-timing-oracle/https://ilias1988.me/bug-bounty/authenticated-connection-validation-timing-oracle/A sanitized bug bounty report documenting a repeatable timing oracle in an authenticated connection-validation workflow and the duplicate triage outcome.Mon, 21 Sep 2026 09:00:00 GMTBug BountyBlind SSRFTiming OracleInternal NetworkResponsible Disclosurehttps://ilias1988.me/writeups/hackthebox/pro-labs/xen/https://ilias1988.me/writeups/hackthebox/pro-labs/xen/Xen chains SMTP phishing, a Citrix breakout, Windows privilege escalation, Kerberoasting, pivoting, NetScaler traffic capture and Backup Operators abuse into full Active Directory compromise.Mon, 21 Sep 2026 00:00:00 GMTactive-directorycitrixphishingsmtp-enumerationwindows-breakoutalways-install-elevatedkerberoastingpivotingpassword-sprayingnetscalerpacket-capturebackup-operatorscredential-dumpingpass-the-hashhttps://ilias1988.me/writeups/hackthebox/challenges/hardware/factory/https://ilias1988.me/writeups/hackthebox/challenges/hardware/factory/Factory exposes an unauthenticated Modbus RTU bridge, allowing PLC mode and valve coils to be manipulated by following the supplied ladder logic.Sun, 20 Sep 2026 00:00:00 GMTics-securityot-securitymodbus-rtuplcladder-logiccoil-manipulationprocess-controlhttps://ilias1988.me/writeups/hackthebox/challenges/hardware/sneak-peek/https://ilias1988.me/writeups/hackthebox/challenges/hardware/sneak-peek/A custom Modbus/TCP service exposes PLC memory writes, allowing a stored MD5 password digest to be replaced and authentication bypassed safely.Sat, 19 Sep 2026 00:00:00 GMTics-securityot-securitymodbus-tcpcustom-protocolplc-memoryauthentication-bypasspythonhttps://ilias1988.me/writeups/hackthebox/challenges/forensics/watch-tower/https://ilias1988.me/writeups/hackthebox/challenges/forensics/watch-tower/A Modbus/TCP packet capture hides an encoded message in register addresses, demonstrating how protocol metadata can become a covert data channel.Thu, 17 Sep 2026 00:00:00 GMTnetwork-forensicsics-securitymodbus-tcppcap-analysisprotocol-analysiscovert-channelhttps://ilias1988.me/writeups/hackthebox/challenges/web/omniwatch/https://ilias1988.me/writeups/hackthebox/challenges/web/omniwatch/OmniWatch chains Zig CRLF response splitting, Varnish cache poisoning, bot-targeted XSS, firmware LFI, JWT forgery and stacked SQL injection.Wed, 16 Sep 2026 00:00:00 GMTweb-securitycrlf-injectionhttp-response-splittingvarnish-cache-poisoningcross-site-scriptingrace-conditionlocal-file-inclusionjwt-forgerystacked-sql-injectionsource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/socrates-panel/https://ilias1988.me/writeups/hackthebox/challenges/web/socrates-panel/SocratesPanel chains fat-GET cache poisoning, reflected XSS, an admin-only SSRF and Redis inline-command injection to recover a cached secret.Tue, 15 Sep 2026 00:00:00 GMTweb-cache-poisoningfat-getreflected-xssrace-conditionssrfredisprotocol-confusiontornadohttps://ilias1988.me/writeups/hackthebox/challenges/web/phantomfeed/https://ilias1988.me/writeups/hackthebox/challenges/web/phantomfeed/PhantomFeed chains a ReDoS-amplified registration race, Nuxt open redirect and OAuth token theft with ReportLab RCE to recover the flag.Mon, 14 Sep 2026 00:00:00 GMTweb-securityrace-conditionregular-expression-dosoauth2open-redirectcross-site-scriptingreportlabremote-code-executionsource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/alien-complaint-form/https://ilias1988.me/writeups/hackthebox/challenges/web/alien-complaint-form/Alien Complaint Form combines stored HTML injection with an unsafe same-origin JSONP callback to bypass CSP and expose a bot-only cookie.Sun, 13 Sep 2026 00:00:00 GMTweb-securitystored-xsscsp-bypassjsonphtml-injectionpuppeteersource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/htb-proxy/https://ilias1988.me/writeups/hackthebox/challenges/web/htb-proxy/HTB Proxy chains a DNS-based SSRF filter bypass, HTTP request smuggling and shell command injection to expose a randomized flag file.Sat, 12 Sep 2026 00:00:00 GMTweb-securityssrfhttp-request-smugglingcommand-injectionparser-differentialdns-filter-bypasssource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/nexus-void/https://ilias1988.me/writeups/hackthebox/challenges/web/nexus-void/Nexus Void chains scoped SQLite injection with unsafe Json.NET type handling to instantiate a command-running setter and achieve root code execution.Fri, 11 Sep 2026 00:00:00 GMTweb-securitysql-injectionunsafe-deserializationdotnetjson-netremote-code-executionsource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/volnaya-forums/https://ilias1988.me/writeups/hackthebox/challenges/web/volnaya-forums/Volnaya Forums chains nginx CRLF response splitting, path-scoped session fixation and self-XSS to execute code in an authenticated admin browser.Thu, 10 Sep 2026 00:00:00 GMTweb-securitycrlf-injectionsession-fixationstored-xsscookie-pathheadless-browsersource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/e-tree/https://ilias1988.me/writeups/hackthebox/challenges/web/e-tree/E.Tree turns unsafe XPath construction into a boolean oracle, allowing two XML secret fragments to be recovered character by character.Wed, 09 Sep 2026 00:00:00 GMTweb-securityxpath-injectionblind-injectionxmlresponse-oraclesource-code-reviewhttps://ilias1988.me/writeups/hackthebox/challenges/web/phonebook/https://ilias1988.me/writeups/hackthebox/challenges/web/phonebook/Phonebook exposes an LDAP wildcard injection that bypasses authentication and creates a response oracle for recovering a password one character at a time.Tue, 08 Sep 2026 00:00:00 GMTweb-securityldap-injectionauthentication-bypassblind-injectionresponse-oracleautomationhttps://ilias1988.me/writeups/hackthebox/machines/perspective/https://ilias1988.me/writeups/hackthebox/machines/perspective/Perspective chains SSI file disclosure, forged ASP.NET authentication, RC4 keystream reuse, ViewState deserialization and an AES padding oracle.Mon, 07 Sep 2026 00:00:00 GMTaspnetiisserver-side-includesauthentication-forgeryssrfrc4viewstate-deserializationpadding-oraclecommand-injectionhttps://ilias1988.me/writeups/hackthebox/machines/crossfittwo/https://ilias1988.me/writeups/hackthebox/machines/crossfittwo/CrossFitTwo chains WebSocket SQL injection, DNS rebinding, CSWSH, Node.js module hijacking and YubiKey OTP forgery to achieve full OpenBSD root access.Sun, 06 Sep 2026 00:00:00 GMTopenbsdwebsocket-sqliarbitrary-file-readunbounddns-rebindinghost-header-injectioncorscswshnodejs-module-hijackingsuidyubikeyhttps://ilias1988.me/writeups/hackthebox/machines/mailroom/https://ilias1988.me/writeups/hackthebox/machines/mailroom/A practical Mailroom walkthrough chaining stored XSS, internal SSRF, MongoDB injection, container command injection, and KeePass keystroke capture.Fri, 04 Sep 2026 00:00:00 GMTstored-xssssrfnosql-injectionmongodbsource-code-reviewcommand-injectiondockerlateral-movementkeepasslinux-privilege-escalationhttps://ilias1988.me/labs/windows/scf-forced-ntlm-authentication-detection/https://ilias1988.me/labs/windows/scf-forced-ntlm-authentication-detection/A controlled SCF-file lab for testing remote icon-triggered NTLM authentication, separating legacy Chrome behavior from current Windows exposure and defensive telemetry.Thu, 03 Sep 2026 12:00:00 GMTSCFForced AuthenticationNetNTLMv2Windows ExplorerSMBResponderDetection Engineeringhttps://ilias1988.me/writeups/hackthebox/machines/caption/https://ilias1988.me/writeups/hackthebox/machines/caption/Caption chains Git history, Varnish cache poisoning, XSS, H2C smuggling, copyparty traversal and Apache Thrift command injection for root access.Thu, 03 Sep 2026 00:00:00 GMTweb-cache-poisoningweb-cache-deceptionxssrequest-smugglingh2cssrfpath-traversalcommand-injectionlinux-privilege-escalationgitbucketvarnishhaproxyapache-thrifthttps://ilias1988.me/labs/windows/bruteforcing-windows-defender-exclusions/https://ilias1988.me/labs/windows/bruteforcing-windows-defender-exclusions/A validated Windows lab showing how MpCmdRun.exe reveals a Defender-excluded directory through a distinctive skipped-scan response, with detection and mitigation guidance.Wed, 02 Sep 2026 10:00:00 GMTMicrosoft DefenderMpCmdRunAV ExclusionsWindows SecuritySecurity ResearchDetection EngineeringLiving off the Landhttps://ilias1988.me/writeups/hackthebox/machines/validation/https://ilias1988.me/writeups/hackthebox/machines/validation/Validation turns a stored SQL injection into MySQL FILE abuse, a PHP web shell, a www-data foothold, and root through reused database credentials.Wed, 02 Sep 2026 00:00:00 GMTweb-securitysql-injectionmysqlinformation-schemafile-privilegephp-webshellpassword-reuseprivilege-escalationhttps://ilias1988.me/labs/windows/mark-of-the-web-forensics-tracing-download-origins/https://ilias1988.me/labs/windows/mark-of-the-web-forensics-tracing-download-origins/A practical Windows forensics blueprint for inspecting Zone.Identifier metadata, tracing download origins, testing Unblock behavior and monitoring MOTW creation.Wed, 02 Sep 2026 00:00:00 GMTMark of the WebMOTWZone.IdentifierNTFS ADSWindows ForensicsSmartScreenDigital Forensicshttps://ilias1988.me/labs/red-team/sliver-netsh-helper-dll-persistence-detection/https://ilias1988.me/labs/red-team/sliver-netsh-helper-dll-persistence-detection/A validated red-team lab combining Sliver staging with a custom Netsh Helper DLL, event-triggered persistence and Microsoft Defender detection analysis.Tue, 01 Sep 2026 07:00:00 GMTSliver C2Netsh Helper DLLWindows PersistencemTLSStagingC++Microsoft DefenderDetection EngineeringMITRE ATT&CKhttps://ilias1988.me/labs/network/dns-txt-powershell-command-retrieval-staging-detection/https://ilias1988.me/labs/network/dns-txt-powershell-command-retrieval-staging-detection/A controlled lab that stores a harmless PowerShell instruction in DNS TXT, retrieves and validates it from Windows, then studies DNS, process and script telemetry.Tue, 01 Sep 2026 06:00:00 GMTDNSTXT RecordsPowerShellDetection EngineeringScript Block LoggingSysmonStagingNetwork Telemetryhttps://ilias1988.me/writeups/hackthebox/machines/soccer/https://ilias1988.me/writeups/hackthebox/machines/soccer/A practical Hack The Box Soccer walkthrough covering Tiny File Manager RCE, blind WebSocket SQL injection, SSH access, and doas/dstat privilege escalation.Tue, 01 Sep 2026 00:00:00 GMTweb-enumerationdefault-credentialsfile-uploadremote-code-executionwebsocketblind-sql-injectionsshdoasdstatprivilege-escalationhttps://ilias1988.me/labs/windows/lnk-hta-polyglot-code-execution-detection-persistence/https://ilias1988.me/labs/windows/lnk-hta-polyglot-code-execution-detection-persistence/A controlled Windows research lab that builds a benign LNK–HTA polyglot, studies its execution chain, maps forensic telemetry and tests safe Startup persistence.Tue, 01 Sep 2026 00:00:00 GMTLNKHTAMSHTAWindowsDetection EngineeringPersistenceDigital ForensicsPolyglot Fileshttps://ilias1988.me/writeups/hackthebox/machines/ghost/https://ilias1988.me/writeups/hackthebox/machines/ghost/A hands-on Ghost lab journal: LDAP injection, Gitea source review, Linux and Kerberos pivots, Golden SAML, linked MSSQL, in-memory privilege escalation and forest compromise.Mon, 31 Aug 2026 00:00:00 GMTactive-directoryldap-injectionpath-traversalcommand-injectionkerberosgmsagolden-samllinked-mssqldomain-trustgolden-tickethttps://ilias1988.me/writeups/hackthebox/machines/nodeblog/https://ilias1988.me/writeups/hackthebox/machines/nodeblog/Hack The Box NodeBlog walkthrough: JSON NoSQL injection, XXE source disclosure, node-serialize RCE, an admin shell, and sudo privilege escalation.Mon, 31 Aug 2026 00:00:00 GMTnodejsexpressnosql-injectionmongodbxxeinsecure-deserializationremote-code-executionsudo