medium - R:Null's hacky things

HTB - Writer Write-up

3 years ago 12 min read hackthebox medium writeup apt-get update disclaimer sql injection python mysql hash cracking filter smtp programming cronjob gtfobins

Rated Medium by HackTheBox and created by TheCyberGeek. Through this machine, we learn about the importance of sanitising inputs, having proper password management and policies, proper privilege segmentation and proper directory permissions.

HTB - Schooled Write-up

3 years ago 10 min read hackthebox medium writeup cve moodle xss session pkg gtfobins

Vulnerabilities/bad configurations exploited 1. XSS in Moodle LMS to steal Teacher session. 2. Moodle LMS privilege escalation from Teacher role to Manager role (CVE-2020-14321). 3. Weak password/password re-use 4. User sudo

HTB - The Notebook Write-up

3 years ago 7 min read hackthebox medium writeup jwt docker cve

Rated Medium from HackTheBox, created by mostwanted002. We learn about bad practices in storing static java web tokens in cookies and breaking out of docker via runC based on CVE-2019-5736.

HTB - Ophiuchi Write-up

3 years ago 9 min read hackthebox medium writeup snakeyaml deserialization relative path programming

Rated Medium by HackTheBox, created by felamos. Through this machine, we learn about a YAML deserialization vulnerability, the horror of password re-use and bad programming practices by using relative paths for critical files.