$ htb.writeups()
// HackTheBox machine walkthroughs — terminal logs, task Q&A, and blurred flags. Click any machine to see the full writeup.
Appointment
A web application running on port 80 is vulnerable to SQL injection. By appending a MySQL comment character (#) to the username field, we bypass password validation entirely and log in as admin without knowing the password.
Sequel
A MariaDB MySQL server is exposed on port 3306 and allows unauthenticated login as the root user. We enumerate databases and tables to find the flag stored in the config table of the htb database.
Crocodile
FTP anonymous login exposes two files: a userlist and password list. We use gobuster to find login.php, then use the harvested credentials to authenticate as admin via the web interface.
Responder
A Windows web server redirects to unika.htb. The 'page' parameter is vulnerable to LFI/RFI. By pointing it to our Responder listener, the server authenticates to us leaking an NTLMv2 hash. John the Ripper cracks the hash to reveal the administrator password, which we use to access the machine via WinRM on port 5985.
Archetype
An SMB share named 'backups' is accessible without credentials, containing a configuration file with MSSQL credentials. We connect to the SQL server and enable xp_cmdshell for command execution. WinPEAS reveals ConsoleHost_history.txt with the administrator password.
Oopsie
A web application's login page at /cdn-cgi/login uses cookies for access control. By changing the role cookie and access ID to the admin's (34322), we gain access to a file upload feature. Uploaded PHP shells land in /uploads. Privilege escalation via a SUID binary that calls 'cat' without a full path — PATH injection gives root.
Vaccine
Anonymous FTP yields a password-protected backup.zip. zip2john extracts a crackable hash — password reveals admin credentials for the web app. SQLmap with --os-shell gains a system shell as postgres. The postgres user can run vi as root via sudo, which drops into a root shell via vi's shell escape.
Unified
UniFi Network 6.4.54 on port 8443 is vulnerable to Log4Shell (CVE-2021-44228). A JNDI LDAP payload in the remember field triggers an outbound LDAP callback. We intercept via tcpdump on port 389, then enumerate MongoDB (port 27117) to update the admin password hash and log in, finally reading the root credentials.
// Writeups cover SQL injection, MSSQL xp_cmdshell, Log4Shell, NTLM hash capture, SUID abuse, WinRM, and MongoDB manipulation.
If this helped you, consider supporting AbleHearts.org — helping those in need.