Threat Ninja Security Awareness

Completed another Hack The Box machine: Devhub (Medium). Devhub was a great exercise in exploring modern development tooling, service misconfigurations, and Linux privilege escalation. The journey began with web enumeration and identifying an exposed MCP Inspector service. Further investigation revealed a command injection vulnerability that provided initial access to the machine. From there, internal service enumeration uncovered a localhost-only Jupyter instance. Accessing it through SSH port forwarding and investigating its authentication mechanism opened the path to another user. The final stage involved examining an internal operations service, understanding its exposed functionality, and identifying a weakness that ultimately led to root access. Devhub highlights how development tools, internal services, and poorly secured administrative functionality can create unexpected attack paths when combined. Another valuable machine for practising enumeration, lateral movement between local users, and privilege escalation. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #MCP #InfoSec … Learn MoreHack The Box: Devhub Machine Walkthrough – Medium Difficulty The post Hack The Box: Devhub Machine Walkthrough – Medium Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine: Reactor, an Easy-difficulty Linux challenge. The initial foothold came from enumerating the Next.js application running on port 3000. Version fingerprinting identified a vulnerable React canary release associated with CVE-2025-55182 (React2Shell). Further testing confirmed remote code execution through the React Server Components functionality, providing access as the node user. From the application environment, the SQLite database exposed credentials for the engineer account. After recovering the password from the stored MD5 hash, SSH access provided the user-level foothold. For privilege escalation, process enumeration revealed a root-owned Node.js service with the inspector exposed on localhost. The Node inspector provided a path to execute code within the root process and modify /bin/bash permissions, ultimately leading to a root shell. I also explored an alternative approach using SSH local port forwarding and Chrome DevTools to access the remote Node inspector. Another useful HTB machine for practicing web enumeration, version fingerprinting, application-layer exploitation, Linux enumeration, and Node.js debugging interfaces. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #OffensiveSecurity #WebSecurity #Linux #NextJS #React #NodeJS #CVE #PrivilegeEscalation #CTF #CyberSecurityLearning … Learn MoreHack The Box: Reactor Machine Walkthrough – Easy Difficulty The post Hack The Box: Reactor Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

Completed another Hack The Box machine, SmartHire, rated Medium difficulty. The attack path started with the SmartHIRE web application and its MLflow integration. Enumeration of the application exposed a vulnerable model workflow that allowed a reverse shell as the low-privileged svcweb user. After gaining access to the host, further enumeration revealed opportunities for privilege escalation. The escalation path focused on the MLflow control script, which allowed malicious plugin code to execute with root privileges. This ultimately enabled the creation of a SUID Bash binary and provided a root shell. The final step was reading /root/root.txt to retrieve the root flag. This machine provided a practical look at attacking MLflow-based applications, moving from web application exploitation to Linux privilege escalation, and chaining multiple weaknesses to achieve full system access. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #WebSecurity #Linux #MLflow #PrivilegeEscalation #OffensiveSecurity #RedTeam #EthicalHacking #InfoSec #CyberSecurityLearning #CTF #HTBWriteup … Learn MoreHack The Box: Smarthire Machine Walkthrough – Medium Difficulity The post Hack The Box: Smarthire Machine Walkthrough – Medium Difficulity appeared first on Threatninja.net.

Completed another Hack The Box machine: Hercules, an Insane difficulty Active Directory challenge. This was one of the longer attack chains I have worked through, involving multiple stages across web exploitation, credential access, Active Directory enumeration, privilege escalation, AD CS, and Kerberos abuse. The initial foothold started with LDAP username enumeration and the discovery of credentials stored in an account description. After gaining access to the Hercules Portal, a directory traversal vulnerability exposed the web.config file and its ASP.NET machineKey values. These values allowed a forged Forms Authentication cookie to impersonate web_admin. From there, a malicious ODT upload triggered an outbound NTLM authentication attempt, allowing the NetNTLMv2 credentials for natalie.a to be captured and cracked. The recovered credentials opened the path to Shadow Credentials against bob.w and stephen.m, followed by OU permission abuse to gain control of the Auditor account. The privilege escalation chain continued through the Forest Migration OU, where fernando.r was enabled and used to identify an ESC3 misconfiguration. An Enrollment Agent certificate was then obtained and abused to request a certificate for ashley.b, leading to further access within the domain. The final stages involved controlling IIS_Administrator, taking control of the iis_webserver$ machine account, extracting the required Kerberos session key, and abusing S4U2self/S4U2proxy to impersonate Administrator. This ultimately provided access to the root flag under C:\Users\Admin\Desktop. Hercules was a great exercise in chaining several seemingly separate weaknesses together rather than relying on a single vulnerability. Definitely a box that required careful enumeration and keeping track of the relationships between users, groups, OUs, certificates, and Kerberos tickets. Documented as part of my continued HTB practice and learning in Active Directory and offensive security. #HackTheBox #HTB #Hercules #CyberSecurity #ActiveDirectory #PenetrationTesting #RedTeam #OffensiveSecurity #BloodHound #Certipy #ADCS #ESC3 #Kerberos #ShadowCredentials #PrivilegeEscalation #InfoSec #CyberSecurityLearning … Learn MoreHack The Box: Hercules Machine Walkthrough – Insane Diffucility The post Hack The Box: Hercules Machine Walkthrough – Insane Diffucility appeared first on Threatninja.net.

Completed another Hack The Box machine, Silentium. Initial access was achieved by exploiting a password-reset vulnerability in the staging Flowise application, followed by abusing a custom MCP endpoint to obtain a root shell inside the Flowise container. Credentials exposed through the container environment were then used to SSH into the underlying host as ben and retrieve the flag. For privilege escalation, an internal Gogs instance was discovered through local port forwarding. A malicious symlink was pushed and manipulated through the Gogs API to target /etc/sudoers.d/ben, allowing a passwordless sudo rule to be written and ultimately providing full root access. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #Linux #PrivilegeEscalation #WebSecurity #CTF … Learn MoreHack The Box: Silentium Machine Walkthrough – Easy Difficulity The post Hack The Box: Silentium Machine Walkthrough – Easy Difficulity appeared first on Threatninja.net.

Completed the Hack The Box “Pirate” machine, a hard-difficulty Active Directory challenge that required chaining multiple attack paths rather than relying on a single vulnerability. The enumeration phase uncovered domain users, pre-created computer accounts, GMSAs, delegation relationships, and an exposed internal network. Access to gMSA_ADFS_prod$ led to DC01 and enabled an internal pivot to WEB01. From there, the attack chain involved GMSA credential retrieval, NTLM relay, authentication coercion, shadow credentials, certificate-based authentication, and Kerberos ticket abuse. The privilege escalation path continued through constrained delegation and resource-based constrained delegation. Kerberos ticket manipulation ultimately provided Administrator access to the domain controller, followed by a SYSTEM-level shell and extraction of domain credentials from NTDS.dit. Both the user and root flags were successfully obtained. Another challenging AD machine completed and another deep dive into Windows authentication, delegation, and privilege escalation. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #ActiveDirectory #RedTeam #Kerberos #NTLMRelay #ShadowCredentials #GMSA #PrivilegeEscalation #WindowsSecurity #Cybersecurity #Infosec #HTBWriteup … Learn MoreHack The Box: Pirate Machine Walkthrough – Hard Difficulity The post Hack The Box: Pirate Machine Walkthrough – Hard Difficulity appeared first on Threatninja.net.

Completed the Hack The Box “CobbleStone” Insane machine, chaining multiple vulnerabilities to achieve full system compromise. Initial access was achieved through SSRF in the skin suggestion feature, followed by SQL injection and stored XSS to compromise the administrator’s session. The stolen session cookie provided admin access, leading to Twig SSTI and RCE as www-data. Database credentials recovered through SSTI enabled a database dump and password cracking, resulting in SSH access as cobble and the user flag. Local enumeration revealed Cobbler’s XML-RPC service on port 25151. After identifying Cobbler 3.3.6 as vulnerable to CVE-2024-47533, a malicious Cheetah template was used to execute commands with root privileges. This provided a root shell and access to /root/root.txt. #HackTheBox #HTB #CobbleStone #CyberSecurity #PenetrationTesting #OffensiveSecurity #WebSecurity #SSRF #SQLInjection #XSS #SSTI #PrivilegeEscalation #CVE-2024-47533 … Learn MoreHackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty The post HackTheBox: CobbleStone Machine Walkthrough – Insane Difficulty appeared first on Threatninja.net.

Completed the Hack The Box “Helix” machine, a medium-difficulty Linux challenge focused on Apache NiFi and industrial control systems. The attack chain involved virtual host discovery, Apache NiFi exploitation, reverse shell access as nifi, recovery of an SSH private key, and lateral movement to the operator user. Privilege escalation was achieved by interacting with the internal OPC UA server and manipulating reactor control values to open the privileged maintenance window, ultimately obtaining root access. Another great HTB challenge combining web exploitation, credential recovery, Linux privilege escalation, and OT/ICS concepts. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #ApacheNiFi #OPCUA #ICS #OTSecurity #PrivilegeEscalation #CTF … Learn MoreHack The Box: Helix Machine – Medium Difficulty The post Hack The Box: Helix Machine – Medium Difficulty appeared first on Threatninja.net.

Completed the Hack The Box “Kobold” machine, an easy-difficulty Linux challenge focused on web exploitation and container-based privilege escalation. The assessment involved identifying and exploiting an unauthenticated Remote Code Execution vulnerability (CVE-2026-23744) in MCPJam Inspector to gain initial access as the ben user. During the privilege escalation phase, I explored Docker security weaknesses by leveraging excessive group permissions to escape the container environment and obtain root access. Additionally, I analyzed an alternative attack path involving CVE-2025-64714 in PrivateBin, which allowed sensitive configuration data exposure and access to the Arcane container management interface. This machine provided practical experience in vulnerability exploitation, container security assessment, and identifying risks associated with exposed internal services. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #OffensiveSecurity #RedTeam #Linux #Docker #VulnerabilityManagement #CVE #EthicalHacking #CybersecurityLearning … Learn MoreHack The Box: Kobold Machine Walkthrough – Easy Difficulty The post Hack The Box: Kobold Machine Walkthrough – Easy Difficulty appeared first on Threatninja.net.

Just wrapped up another Hack The Box machine: Fries (Hard). TThis machine provided a realistic attack path that started with source code review in Gitea, where leaked credentials in a Git commit led to authenticated PostgreSQL RCE through pgAdmin. From there, I pivoted through the internal Docker network using Ligolo-ng, abused an exposed NFS share and debugfs to gain host access, then exploited PWM configuration weaknesses to capture LDAP credentials. The final stage involved Active Directory enumeration and AD CS (ESC6/ESC7) abuse to obtain an administrator certificate and compromise the domain. A great lab for practising web exploitation, Docker security, Linux privilege escalation, internal pivoting, and Active Directory attacks. #HackTheBox #HTB #CyberSecurity #PenetrationTesting #RedTeam #ActiveDirectory #ADCS #Docker #Ligolo #PostgreSQL #Gitea #EthicalHacking #Writeup #CTF … Learn MoreHack The Box: Fries Machine Walkthrough – Hard Difficulty The post Hack The Box: Fries Machine Walkthrough – Hard Difficulty appeared first on Threatninja.net.