Hack The Box
Hack The Box Sherlock — Unit42
A Sysmon EVTX investigation tracing a cloud-hosted installer through execution, file staging, timestamp changes, network activity and process exit.
Read write-uproot@kali:~$ ls ./writeups
Hack The Box Write-ups
Reproducible attack paths and evidence-led investigations from authorized Hack The Box Machines, Challenges, Sherlocks and retired Pro Labs.
Knowledge base
Field notes from the labs
Browse full machine and Pro Lab attack paths, focused technical challenges and defensive Sherlock investigations.
31 write-ups
Hack The Box
Hack The Box Mini Pro Lab — Hades
Hades chains command injection, an internal SOCKS pivot, Kerberos abuse, VSS/DPAPI, RBCD and ADIDNS into full Active Directory compromise.
Read write-up
Hack The Box
Hack The Box Sherlock — LogJammer
A reproducible Windows EVTX investigation correlating logons, Defender detections, firewall changes, scheduled tasks, PowerShell activity and log clearing.
Read write-up
Hack The Box
Armaxis
Armaxis chains an unbound password-reset token with Markdown image file fetching to take over the admin account and read a server-side flag as Base64.
Read write-up
Hack The Box
Hack The Box — Timelapse
Timelapse exposes a guest-readable SMB backup; cracking its ZIP and PFX enables certificate WinRM, while PowerShell history and LAPS lead to Administrator.
Read write-up
Hack The Box
Hack The Box Mini Pro Lab — P.O.O.
P.O.O. chains exposed IIS metadata, an MSSQL linked-server trust loop, IPv6 WinRM and Kerberoasting into full Active Directory compromise.
Read write-up
Hack The Box
Hack The Box — Knife
Knife exposes a backdoored PHP 8.1.0-dev runtime through HTTP; a crafted header gives a james shell, and sudo access to Chef knife leads to root.
Read write-up
Hack The Box
Hack The Box — Remote
Remote exposes an NFS backup with Umbraco credentials; authenticated CMS RCE yields an IIS shell, and TeamViewer password reuse leads to SYSTEM.
Read write-up
Hack The Box
Hack The Box — MetaTwo
MetaTwo chains BookingPress SQL injection, WordPress Media Library XXE, exposed FTP and SSH credentials, and Passpie key cracking to reach root.
Read write-up Hack The Box
Hack The Box Challenge — Intrusion
Modbus/TCP write acknowledgements expose a sparse register map, enabling an unauthenticated client to recover sensitive data with targeted reads.
Read write-up
Hack The Box
Hack The Box Pro Lab — Xen
Xen chains SMTP phishing, a Citrix breakout, Windows privilege escalation, Kerberoasting, pivoting, NetScaler traffic capture and Backup Operators abuse into full Active Directory compromise.
Read write-up Hack The Box
Hack The Box Challenge — Factory
Factory exposes an unauthenticated Modbus RTU bridge, allowing PLC mode and valve coils to be manipulated by following the supplied ladder logic.
Read write-up Hack The Box
Hack The Box Challenge — Sneak peek
A custom Modbus/TCP service exposes PLC memory writes, allowing a stored MD5 password digest to be replaced and authentication bypassed safely.
Read write-up Hack The Box
Hack The Box Challenge — Watch Tower
A Modbus/TCP packet capture hides an encoded message in register addresses, demonstrating how protocol metadata can become a covert data channel.
Read write-up Hack The Box
Hack The Box Challenge — OmniWatch
OmniWatch chains Zig CRLF response splitting, Varnish cache poisoning, bot-targeted XSS, firmware LFI, JWT forgery and stacked SQL injection.
Read write-up Hack The Box
Hack The Box Challenge — SocratesPanel
SocratesPanel chains fat-GET cache poisoning, reflected XSS, an admin-only SSRF and Redis inline-command injection to recover a cached secret.
Read write-up Hack The Box
Hack The Box Challenge — PhantomFeed
PhantomFeed chains a ReDoS-amplified registration race, Nuxt open redirect and OAuth token theft with ReportLab RCE to recover the flag.
Read write-up Hack The Box
Hack The Box Challenge — Alien Complaint Form
Alien Complaint Form combines stored HTML injection with an unsafe same-origin JSONP callback to bypass CSP and expose a bot-only cookie.
Read write-up Hack The Box
Hack The Box Challenge — HTB Proxy
HTB Proxy chains a DNS-based SSRF filter bypass, HTTP request smuggling and shell command injection to expose a randomized flag file.
Read write-up Hack The Box
Hack The Box Challenge — Nexus Void
Nexus Void chains scoped SQLite injection with unsafe Json.NET type handling to instantiate a command-running setter and achieve root code execution.
Read write-up Hack The Box
Hack The Box Challenge — Volnaya Forums
Volnaya Forums chains nginx CRLF response splitting, path-scoped session fixation and self-XSS to execute code in an authenticated admin browser.
Read write-up Hack The Box
Hack The Box Challenge — E.Tree
E.Tree turns unsafe XPath construction into a boolean oracle, allowing two XML secret fragments to be recovered character by character.
Read write-up Hack The Box
Hack The Box Challenge — Phonebook
Phonebook exposes an LDAP wildcard injection that bypasses authentication and creates a response oracle for recovering a password one character at a time.
Read write-up
Hack The Box
Hack The Box — Perspective: ASP.NET Crypto Exploitation
Perspective chains SSI file disclosure, forged ASP.NET authentication, RC4 keystream reuse, ViewState deserialization and an AES padding oracle.
Read write-up
Hack The Box
Hack The Box — CrossFitTwo
CrossFitTwo chains WebSocket SQL injection, DNS rebinding, CSWSH, Node.js module hijacking and YubiKey OTP forgery to achieve full OpenBSD root access.
Read write-up
Hack The Box
Hack The Box — Mailroom
A practical Mailroom walkthrough chaining stored XSS, internal SSRF, MongoDB injection, container command injection, and KeePass keystroke capture.
Read write-up
Hack The Box
Hack The Box — Caption
Caption chains Git history, Varnish cache poisoning, XSS, H2C smuggling, copyparty traversal and Apache Thrift command injection for root access.
Read write-up
Hack The Box
Hack The Box — Validation
Validation turns a stored SQL injection into MySQL FILE abuse, a PHP web shell, a www-data foothold, and root through reused database credentials.
Read write-up
Hack The Box
Hack The Box — Soccer
A practical Hack The Box Soccer walkthrough covering Tiny File Manager RCE, blind WebSocket SQL injection, SSH access, and doas/dstat privilege escalation.
Read write-up
Hack The Box
Hack The Box — Ghost
A hands-on Ghost lab journal: LDAP injection, Gitea source review, Linux and Kerberos pivots, Golden SAML, linked MSSQL, in-memory privilege escalation and forest compromise.
Read write-up
Hack The Box
Hack The Box — NodeBlog
Hack The Box NodeBlog walkthrough: JSON NoSQL injection, XXE source disclosure, node-serialize RCE, an admin shell, and sudo privilege escalation.
Read write-upNo matching write-ups
Try a broader search or clear one of the filters.
Publication standard
Built for learning, not spoilers
Verified steps
Only commands, analysis and findings reproduced during the solve are documented.
Sanitized evidence
Flags, personal secrets, VPN data and unrelated tokens are removed before publication.
Publishable content
Public entries are limited to content permitted by Hack The Box publication rules.