https://blog-ga2.pages.dev/categories/hackthebox/ Recent content in HackTheBox on burkocyigit Hugo en No rights reserved. Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/editorial/ Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/editorial/ Walkthrough of HackTheBox Editorial — exploiting SSRF to enumerate internal API endpoints, extracting credentials from API responses, git history credential hunting, and abusing git ext protocol for root shell. https://blog-ga2.pages.dev/posts/monteverde/ Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/monteverde/ Walkthrough of HackTheBox Monteverde — a Windows Active Directory machine involving SMB null session user enumeration, password spraying, credential extraction from SMB shares, and Azure AD Connect abuse to dump domain admin credentials. https://blog-ga2.pages.dev/posts/querier/ Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/querier/ Walkthrough of HackTheBox Querier — extracting MSSQL credentials from Excel macros, stealing NTLMv2 hashes via xp_dirtree and Responder, gaining RCE through xp_cmdshell, and privilege escalation with GodPotato via SeImpersonatePrivilege. https://blog-ga2.pages.dev/posts/sauna/ Sun, 16 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/sauna/ Walkthrough of HackTheBox Sauna — a Windows Active Directory machine involving username enumeration with username-anarchy, AS-REP Roasting, AutoLogon credential discovery, BloodHound analysis, and DCSync attack. https://blog-ga2.pages.dev/posts/builder/ Fri, 14 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/builder/ Walkthrough of HackTheBox Builder — exploiting Jenkins 2.441 arbitrary file read (CVE-2024-23897) to extract credentials, cracking bcrypt hashes, and using Jenkins Script Console for RCE. https://blog-ga2.pages.dev/posts/forest/ Thu, 13 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/forest/ Walkthrough of HackTheBox Forest — a Windows Active Directory machine involving AS-REP Roasting, BloodHound enumeration, Exchange Windows Permissions abuse, WriteDacl exploitation, and DCSync attack. https://blog-ga2.pages.dev/posts/jeeves/ Thu, 13 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/jeeves/ Walkthrough of HackTheBox Jeeves — discovering an unprotected Jenkins instance on Jetty, Groovy Script Console reverse shell, SeImpersonatePrivilege escalation with JuicyPotato, and NTFS ADS flag recovery. https://blog-ga2.pages.dev/posts/dog/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/dog/ Walkthrough of HackTheBox Dog — extracting credentials from an exposed .git repository, exploiting Backdrop CMS authenticated RCE via malicious module upload, and privilege escalation with GTFOBins. https://blog-ga2.pages.dev/posts/knife/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/knife/ Walkthrough of HackTheBox Knife — exploiting PHP 8.1.0-dev backdoor for instant RCE and privilege escalation via sudo knife (Chef) GTFOBins escape. https://blog-ga2.pages.dev/posts/precious/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/precious/ Walkthrough of HackTheBox Precious — exploiting pdfkit 0.8.6 command injection (CVE-2022-25765), lateral movement via credential discovery, and Ruby YAML deserialization for root shell. https://blog-ga2.pages.dev/posts/codify/ Tue, 11 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/codify/ Walkthrough of HackTheBox Codify — exploiting vm2 sandbox escape (CVE-2023-30547) for RCE, cracking SQLite bcrypt hashes, bash pattern matching bypass, and using pspy to capture runtime credentials. https://blog-ga2.pages.dev/posts/cozyhosting/ Tue, 11 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/cozyhosting/ Walkthrough of HackTheBox CozyHosting — exploiting Spring Boot Actuator session leakage, OS command injection with whitespace bypass, PostgreSQL credential extraction, and sudo ssh GTFOBins escape. https://blog-ga2.pages.dev/posts/active/ Mon, 10 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/active/ Walkthrough of HackTheBox Active — a Windows Domain Controller machine involving SMB null session enumeration, GPP cpassword decryption, and Kerberoasting to gain Domain Admin. https://blog-ga2.pages.dev/posts/busqueda/ Mon, 10 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/busqueda/ Walkthrough of HackTheBox Busqueda — exploiting Searchor 2.4.0 command injection (CVE-2023-43364), credential hunting in .git config, and abusing relative path execution for root.