HackTheBox - Explore

Explore is a fun Android box that has an Open Port Vulnerability because of a popular file manager application. This box also has ADB over TCP/IP open over port 5555 which leads to obtaining root privileges.

October 30, 2021 · 4 min · Aditya Telange

HackTheBox - Cap

Cap is a fun box where we find a flask web app which lets us download network log, where we find FTP and SSH credentials for user nathan. The box has python which has capability to set UIDs, which lets us access roots shell, when UID is set to 0.

October 2, 2021 · 4 min · Aditya Telange

HackTheBox - Knife

Knife is a fun box which uses a PHP version having backdoor, which leads to RCE. The box has a command named knife which lets non-superusers run commanad as root.

August 28, 2021 · 2 min · Aditya Telange

HackTheBox - Love

Love is a fun box where we find a hidden subdomain that helps us retrieve Forbidden pages, where admin credentials are leaked of another service. The access to the admin dashboard has a file upload, through which we get a reverse shell. The box then has AlwaysInstallElevated that allows a regular user to install a Microsoft Windows Installer Package (MSI) with system privileges, which helps us get the Administrator access.

August 7, 2021 · 5 min · Aditya Telange