Hack The Box
Hack The Box — Era
An IDOR exposes a site backup; a security-question reset grants admin access, SSH2 stream execution yields a shell, and a writable signed ELF grants root.
Read write-uproot@kali:~$ ls ./writeups/machines
HTB Machine Write-ups
Complete, evidence-backed attack paths for retired Hack The Box machines.
Knowledge base
Retired machine archive
From initial enumeration to foothold, privilege escalation and final technical takeaways.
16 write-ups
Hack The Box
Hack The Box — BroScience
Double-encoded LFI exposes predictable activation codes and a PHP deserialization gadget; a cracked salted hash and certificate CN injection lead to root.
Read write-up
Hack The Box
Hack The Box — Imagery
Blind XSS steals an admin session; log traversal exposes source and test account, then image crop injection, an encrypted backup and Charcol cron lead to root.
Read write-up
Hack The Box
Hack The Box — Editorial
Editorial's cover preview exposes an internal API through SSRF; leaked dev credentials, Git history and a sudo-allowed GitPython clone lead to root.
Read write-up
Hack The Box
Hack The Box — Timelapse
Timelapse exposes a guest-readable SMB backup; cracking its ZIP and PFX enables certificate WinRM, while PowerShell history and LAPS lead to Administrator.
Read write-up
Hack The Box
Hack The Box — Knife
Knife exposes a backdoored PHP 8.1.0-dev runtime through HTTP; a crafted header gives a james shell, and sudo access to Chef knife leads to root.
Read write-up
Hack The Box
Hack The Box — Remote
Remote exposes an NFS backup with Umbraco credentials; authenticated CMS RCE yields an IIS shell, and TeamViewer password reuse leads to SYSTEM.
Read write-up
Hack The Box
Hack The Box — MetaTwo
MetaTwo chains BookingPress SQL injection, WordPress Media Library XXE, exposed FTP and SSH credentials, and Passpie key cracking to reach root.
Read write-up
Hack The Box
Hack The Box — Perspective: ASP.NET Crypto Exploitation
Perspective chains SSI file disclosure, forged ASP.NET authentication, RC4 keystream reuse, ViewState deserialization and an AES padding oracle.
Read write-up
Hack The Box
Hack The Box — CrossFitTwo
CrossFitTwo chains WebSocket SQL injection, DNS rebinding, CSWSH, Node.js module hijacking and YubiKey OTP forgery to achieve full OpenBSD root access.
Read write-up
Hack The Box
Hack The Box — Mailroom
A practical Mailroom walkthrough chaining stored XSS, internal SSRF, MongoDB injection, container command injection, and KeePass keystroke capture.
Read write-up
Hack The Box
Hack The Box — Caption
Caption chains Git history, Varnish cache poisoning, XSS, H2C smuggling, copyparty traversal and Apache Thrift command injection for root access.
Read write-up
Hack The Box
Hack The Box — Validation
Validation turns a stored SQL injection into MySQL FILE abuse, a PHP web shell, a www-data foothold, and root through reused database credentials.
Read write-up
Hack The Box
Hack The Box — Soccer
A practical Hack The Box Soccer walkthrough covering Tiny File Manager RCE, blind WebSocket SQL injection, SSH access, and doas/dstat privilege escalation.
Read write-up
Hack The Box
Hack The Box — Ghost
A hands-on Ghost lab journal: LDAP injection, Gitea source review, Linux and Kerberos pivots, Golden SAML, linked MSSQL, in-memory privilege escalation and forest compromise.
Read write-up
Hack The Box
Hack The Box — NodeBlog
Hack The Box NodeBlog walkthrough: JSON NoSQL injection, XXE source disclosure, node-serialize RCE, an admin shell, and sudo privilege escalation.
Read write-upNo matching write-ups
Try a broader search or clear one of the filters.