Writeups
Published Hack The Box writeups and the tags used to organize them.
Published Hack The Box writeups are listed by machine release date, newest first. Drafts are excluded until publication. Select a tag to filter the English documentation.
Machines
Section titled “Machines”On narrow screens, scroll the table horizontally.
| Machine release date | Box Name | OS | Level | Summary | Tags |
|---|---|---|---|---|---|
| Checkpoint | Windows | Medium | dMSA abuse through BadSuccessor and a malicious VS Code extension lead to a service account. A reused Administrator NTLM hash recovered from a VMware memory snapshot provides Domain Admin access. | ||
| DevArea | Linux | Medium | An arbitrary file read in a SOAP service reveals Hoverfly credentials and leads to a shell. SysWatch command injection and flawed symlink checks combine to read files as root. | ||
| SmartHire | Linux | Medium | Default MLflow credentials allow a malicious model to be registered, yielding a shell as svcweb when predictions run. A .pth file in a writable plugin directory executes code as root when a management script runs through sudo. |
||
| Helix | Linux | Medium | Apache NiFi's H2 driver provides a shell, and a leftover SSH private key enables access as operator. Manipulating PLC values through OPC UA opens a maintenance window, allowing a sudo-enabled console to provide a root shell. |
||
| Logging | Windows | Medium | Credentials found in logs on an SMB share enable a Shadow Credentials attack and a user shell. Manipulating AD CS and DNS allows impersonation of a WSUS server and delivery of update commands as SYSTEM. | ||
| Pirate | Windows | Hard | A pre-created computer account and a gMSA provide a path into AD. NTLM relay sets up RBCD; further SPN and delegation changes lead to SYSTEM on the domain controller. | ||
| Fries | Windows | Hard | Gitea and pgAdmin provide a foothold on an Ubuntu host. A key on NFS enables Docker API access, while gMSA and AD CS permissions lead to Administrator on the Windows side. | ||
| CodePartTwo | Linux | Easy | The distributed ZIP reveals js2py==0.74, and an authenticated code execution API yields a shell as app. Cracking marco's password hash from SQLite and using the sudo-enabled npbackup-cli to access a snapshot reveals /root/root.txt. |
||
| Voleur | Windows | Medium | An Excel file on a share and Kerberoasting lead to WinRM access. Recovering a deleted account and decrypting DPAPI data enable backup analysis and access as Administrator. | ||
| TombWatcher | Windows | Medium | Following AD ACL relationships, Kerberoasting, and a gMSA password expands access. Restoring a deleted account and abusing AD CS lead to Administrator. | ||
| Puppy | Windows | Medium | Changing a group ACL opens access to a share, where KeePass data and backups reveal credentials. An account recovered through DPAPI decryption reaches the Administrator desktop. | ||
| Administrator | Windows | Medium | AD ACLs point to credentials in FTP and Password Safe backups. Targeted Kerberoasting and directory replication rights reveal Administrator credentials. | ||
| Certified | Windows | Medium | Following AD ownership and ACLs enables a move to a service account through Shadow Credentials. Certificate template settings and a UPN change allow authentication as Administrator. | ||
| Trick | Linux | Easy | A DNS zone transfer and virtual host enumeration reveal another site; LFI exposes an SSH key. A fail2ban action setting and a sudo restart lead to root. |
How tags are assigned
Section titled “How tags are assigned”The first three tags identify Hack The Box, the OS (Linux or Windows), and the difficulty (Easy, Medium, Hard, or Insane). Technique tags cover only methods used in the main attack path of the writeup.
Technique tags
Section titled “Technique tags”| Tag | Meaning |
|---|---|
Active Directory | Paths involving AD accounts, domains, and permissions |
AD ACL | Abuse of AD object ownership, DACLs, or attribute writes |
AD CS | Abuse of AD Certificate Services or certificate templates |
AD Recycle Bin | Paths that restore deleted AD objects |
gMSA | Abuse of group Managed Service Account credentials or privileges |
dMSA Abuse | Privilege escalation through a delegated Managed Service Account |
Kerberos | Paths centered on tickets, delegation, forgery, or authentication |
Kerberoasting | Obtaining and cracking TGS hashes through SPNs |
RBCD | Abuse of resource-based constrained delegation |
NTLM Relay | Relaying NTLM authentication |
DPAPI | Decrypting credentials protected by DPAPI |
Shadow Credentials | Authentication takeover through msDS-KeyCredentialLink |
Credential Dumping | Extracting hashes or keys from NTDS, registry hives, or memory |
Forest Trust | Abuse of authentication or privileges across a forest trust |
CI/CD | Code execution through builds, workflows, or runners |
MSSQL | Paths involving SQL Server features, authentication, or privileges |
DNS Zone Transfer | Information gathering through DNS AXFR |
NFS | Information gathering or access through NFS shares |
SQL Injection | Injecting input into SQL queries |
Command Injection | Injecting input into command arguments or shell processing |
Template Injection | Code execution through template expressions or ASTs |
SSRF | Reaching internal resources through server-side URL fetches |
XSS | Executing scripts in the browser |
Path Traversal | Accessing files by bypassing path validation |
File Inclusion | Reading files through inclusion features such as LFI |
Arbitrary File Read | Obtaining information through arbitrary file read flaws |
Insecure Deserialization | Loading or executing untrusted serialized data |
Authentication Bypass | Bypassing authentication or password reset flows |
Credential Exposure | Obtaining credentials from exposed data or traffic |
Remote Code Execution | Code execution through product or application flaws and extensions |
Local Privilege Escalation | Host privilege escalation through sudo, service settings, or local vulnerabilities |
Container Escape | Paths that cross container boundaries to gain host privileges |
Docker API | Paths involving Docker API privileges or settings |
Packet Sniffing | Obtaining information by capturing network traffic |
Freja | Inspecting HTTP requests and responses with a proxy |
OPC UA | Paths involving OPC UA node or value manipulation |
Memory Forensics | Paths involving memory dump analysis |
WinRM | Articles focused on WinRM connection or session behavior |
WSUS | Abuse of Windows Server Update Services delivery paths |