https://blog-ga2.pages.dev/tags/linux/ Recent content in Linux on burkocyigit Hugo en No rights reserved. Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/editorial/ Mon, 17 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/editorial/ Walkthrough of HackTheBox Editorial — exploiting SSRF to enumerate internal API endpoints, extracting credentials from API responses, git history credential hunting, and abusing git ext protocol for root shell. https://blog-ga2.pages.dev/posts/builder/ Fri, 14 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/builder/ Walkthrough of HackTheBox Builder — exploiting Jenkins 2.441 arbitrary file read (CVE-2024-23897) to extract credentials, cracking bcrypt hashes, and using Jenkins Script Console for RCE. https://blog-ga2.pages.dev/posts/dog/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/dog/ Walkthrough of HackTheBox Dog — extracting credentials from an exposed .git repository, exploiting Backdrop CMS authenticated RCE via malicious module upload, and privilege escalation with GTFOBins. https://blog-ga2.pages.dev/posts/knife/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/knife/ Walkthrough of HackTheBox Knife — exploiting PHP 8.1.0-dev backdoor for instant RCE and privilege escalation via sudo knife (Chef) GTFOBins escape. https://blog-ga2.pages.dev/posts/precious/ Wed, 12 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/precious/ Walkthrough of HackTheBox Precious — exploiting pdfkit 0.8.6 command injection (CVE-2022-25765), lateral movement via credential discovery, and Ruby YAML deserialization for root shell. https://blog-ga2.pages.dev/posts/codify/ Tue, 11 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/codify/ Walkthrough of HackTheBox Codify — exploiting vm2 sandbox escape (CVE-2023-30547) for RCE, cracking SQLite bcrypt hashes, bash pattern matching bypass, and using pspy to capture runtime credentials. https://blog-ga2.pages.dev/posts/cozyhosting/ Tue, 11 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/cozyhosting/ Walkthrough of HackTheBox CozyHosting — exploiting Spring Boot Actuator session leakage, OS command injection with whitespace bypass, PostgreSQL credential extraction, and sudo ssh GTFOBins escape. https://blog-ga2.pages.dev/posts/busqueda/ Mon, 10 Aug 2026 20:00:00 +0300 https://blog-ga2.pages.dev/posts/busqueda/ Walkthrough of HackTheBox Busqueda — exploiting Searchor 2.4.0 command injection (CVE-2023-43364), credential hunting in .git config, and abusing relative path execution for root.