Threat Ninja Security Awareness

Just completed the Eighteen machine on Hack The Box — a great example of chaining multiple techniques from initial access to full domain compromise. Gained initial foothold by cracking WinRM credentials (adam.scott / iloveyou1) and accessing the system via Evil-WinRM. From there, escalated privileges by abusing Delegated Managed Service Accounts (DMSA) using BadSuccessor, allowing impersonation of the Administrator. Set up a Ligolo-ng tunnel to reach the domain controller, leveraged Kerberos ticket abuse with Impacket, and successfully dumped NTDS secrets. This led to extracting the Administrator NTLM hash and achieving full system compromise via Pass-the-Hash. A solid walkthrough covering credential abuse, AD misconfigurations, Kerberos attacks, and pivoting techniques. #HackTheBox #CyberSecurity #RedTeam #PenetrationTesting #ActiveDirectory #Kerberos #PrivilegeEscalation #EthicalHacking #Infosec #OffensiveSecurity … Learn MoreHack The Box: Eighteen Machine Walkthrough – Easy Difficulity The post Hack The Box: Eighteen Machine Walkthrough – Easy Difficulity appeared first on Threatninja.net.

Just completed the DarkZero machine from HackTheBox (Hard difficulty)! After gaining a foothold on DC02 via a misconfigured MSSQL linked server and escalating to local Administrator using SigmaPotato token impersonation + RunasCs, we successfully captured the user flag from the Administrator’s desktop. Dumped the domain Administrator NT hash with secretsdump, then used Evil-WinRM to get a full shell as Administrator on DC02 and retrieved the root flag. #HackTheBox #HTB #Pentesting #ActiveDirectory #RedTeam #CyberSecurity #PrivilegeEscalation … Learn MoreHack The Box: Darkzero Machine – Hard Difficulity The post Hack The Box: Darkzero Machine – Hard Difficulity appeared first on Threatninja.net.

Completed the Browsed machine on Hack The Box 🚀 Gained initial access by uploading a malicious Chrome extension with a reverse shell payload. Automated testing executed it, giving a foothold as larry and access to user flag. Escalated privileges by abusing a misconfigured sudo rule on extension_tool.py. A world-writable pycache directory allowed bytecode poisoning, leading to root access and full compromise. Great box for practicing client-side attacks, extension abuse, and privilege escalation via Python internals. #HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #PrivilegeEscalation #WebSecurity #CTF … Learn MoreHack The Box: Browsed Machine Walkthrough – Medium Diffucility The post Hack The Box: Browsed Machine Walkthrough – Medium Diffucility appeared first on Threatninja.net.

Successfully completed the Conversor machine on Hack The Box, focusing on web exploitation and privilege escalation techniques. For the user flag, initial access was gained by exploiting an insecure XSLT file upload feature. By leveraging EXSLT, I was able to write and execute a malicious script on the server, resulting in a reverse shell as a low-privileged user. Further enumeration uncovered a SQLite database containing hashed credentials, which were cracked to obtain valid SSH access and retrieve the user flag. For the root flag, privilege escalation was achieved through a misconfigured sudo permission allowing execution of needrestart. This was abused to run a crafted script that modified system binaries, ultimately granting root-level access via a SUID bash shell and completing the machine. #HackTheBox #CyberSecurity #EthicalHacking #PenetrationTesting #WebSecurity #PrivilegeEscalation #RedTeam #InfoSec #CaptureTheFlag #CTF … Learn MoreHack The Box: Conversor Machine Walkhtrough – Easy Difficulity The post Hack The Box: Conversor Machine Walkhtrough – Easy Difficulity appeared first on Threatninja.net.

Completed the Gavel (Medium) machine on Hack The Box. The initial foothold came from an exposed .git directory that leaked the application’s source code and bcrypt password hashes. After cracking the credentials with John the Ripper, I gained access and achieved a reverse shell through command injection in the admin rule field. Reusing the cracked credentials allowed privilege escalation to the application user and retrieval of the user flag. Root access was obtained by abusing the gavel-util submission feature, which executed YAML rule fields using PHP system(). By overwriting the custom php.ini to remove restrictions and creating a SUID Bash binary, it was possible to spawn a root shell and capture the final flag. #HackTheBox #HTB #CyberSecurity #EthicalHacking #PenetrationTesting #RedTeam #LinuxSecurity #WebSecurity #PrivilegeEscalation #CTF … Learn MoreHack The Box: Gavel Machine Walkthrough – Medium Difficulity The post Hack The Box: Gavel Machine Walkthrough – Medium Difficulity appeared first on Threatninja.net.

Just completed Expressway on Hack The Box (Easy difficulty) – a solid box that blends weak IKE PSK cracking with a straightforward sudo privilege escalation! Enumeration started with UDP scanning, which revealed ISAKMP on port 500. I ran ike-scan in Aggressive Mode to leak the peer identity ike@expressway.htb and capture crackable parameters. Next I used psk-crack against rockyou.txt and recovered the PSK freakingrockstarontheroad in under 13 seconds. I logged in via SSH as ike using that password and quickly grabbed user.txt. For privilege escalation, sudo -l confirmed no rights for the ike user. Checking sudo -V showed version 1.9.17 vulnerable to CVE-2025-32463 (chwoot). I cloned the PoC repository on my attack machine, hosted sudo-chwoot.sh with a Python HTTP server, transferred it to the target using curl, made it executable, and ran it. The script printed “woot!” and dropped an instant root shell. From there I read root.txt. Nice and clean chain: weak PSK for initial access followed by a known sudo vulnerability for root. Perfect easy box to sharpen IKE enumeration and Linux local exploitation skills. #HackTheBox #CTF #PenetrationTesting #Cybersecurity #EthicalHacking #IKE #PSKCracking #PrivilegeEscalation #LinuxExploitation #CVE202532463 #RedTeam … Learn MoreHack The Box: Expressway Machine – Easy Difficulity The post Hack The Box: Expressway Machine – Easy Difficulity appeared first on Threatninja.net.

🔐 User Flag — Compromising the Application Layer Successfully rooted the Guardian (Hard) machine on Hack The Box by chaining multiple real-world web vulnerabilities.Initial access was achieved through credential abuse and IDOR within the student portal. Leaked chat credentials exposed internal Gitea repositories containing hardcoded database secrets. A vulnerable XLSX file upload feature allowed formula injection → XSS → session hijacking. Leveraging CSRF, I created a rogue admin account and escalated privileges within the application. From there, an LFI vulnerability combined with a PHP filter chain led to Remote Code Execution. After gaining a shell as www-data, I reused leaked credentials to pivot laterally to user jamil, capturing the user flag. 👑 Root Flag — From Code Injection to Full System Compromise Privilege escalation started with sudo -l, revealing that jamil could execute a Python utility as user mark without a password. Since one of the Python files was writable, I injected code to spawn a shell as mark. Further enumeration uncovered a custom binary (safeapache2ctl) executable as root. A flawed validation mechanism in its Apache config parsing allowed path traversal and arbitrary file inclusion. By crafting a malicious shared object (evil.so) and abusing the wrapper’s improper include validation, I achieved root-level code execution and obtained a root shell. … Learn MoreHack The Box: Guardian Machine Walkthrough – Hard Difficulty The post Hack The Box: Guardian Machine Walkthrough – Hard Difficulty appeared first on Threatninja.net.

Just completed the Giveback machine on Hack The Box (Medium difficulty). Started with Nmap → WordPress + vulnerable GiveWP 3.14.0 (CVE-2024-5932 / CVE-2024-8353 PHP Object Injection) → unauthenticated RCE via donation form PoC → reverse shell as bitnami in a Bitnami Kubernetes pod. Pivoted using mounted K8s service account token → abused the API + exploited a vulnerable legacy PHP-CGI intranet service → broke out to the host as user babywyrm → grabbed user.txt. For root: passwordless sudo on custom /opt/debug binary → used dumped secret as admin password → crafted malicious OCI config.json → ran privileged container via runc breakout → read root.txt. Great chain: web vuln → container escape → K8s lateral → sudo abuse. Loved the real-world Kubernetes misconfig + runc wrapper elements. #HackTheBox #CTF #PenetrationTesting #KubernetesSecurity #ContainerEscape #RCE #PrivilegeEscalation #Cybersecurity … Learn MoreHack The Box: GiveBack machine walkthrough – Medium Difficulity The post Hack The Box: GiveBack machine walkthrough – Medium Difficulity appeared first on Threatninja.net.

Just completed the Soulmate machine on Hack The Box — rated Easy, but packed with a satisfying vuln chain! Started with subdomain enumeration → discovered an exposed CrushFTP admin panel on ftp.soulmate.htb. Exploited an unauthenticated API flaw (CVE-2025-31161 style) in the /WebInterface/function/ endpoint to enumerate users and create a backdoor admin account. From there, abused broken access controls in User Manager to reset the “ben” account password. Logged in as “ben” → gained VFS access to /webProd (the main web root), uploaded a PHP webshell → got RCE as www-data with a reverse shell. Credential reuse let me su ben and grab user.txt Root came via a backdoored Erlang SSH daemon on localhost:2222 (hardcoded always-true auth, running as root) → trivial escalation to root Eshell and root.txt Key takeaways: exposed admin panels are goldmines, weak API auth leads to quick takeovers, credential reuse is still everywhere, and custom services with backdoors can hand you root on a platter. Loved the progression from web misconfig → file write → RCE → local privesc. Solid learning box! #HackTheBox #HTB #CyberSecurity #PenetrationTesting #CTF #PrivilegeEscalation #RCE #BugBounty #RedTeam … Learn MoreHack The Box: Soulmate machine walkthrough – Easy Difficulitty The post Hack The Box: Soulmate machine walkthrough – Easy Difficulitty appeared first on Threatninja.net.

After escalating to a SYSTEM-level PowerShell reverse shell using xp_cmdshell and a base64-encoded payload that called back to my netcat listener on port 9007, I navigated to the user profile and read the user flag directly with type user.txt. With full sysadmin rights on the SQL instance as SIGNED\Administrator (thanks to a forged silver ticket with Domain Admins membership), I enabled xp_cmdshell, launched a reverse shell to land SYSTEM access, then grabbed the root flag from Box fully pwned — domain admin and SYSTEM in the bag! #HackTheBox #HTBSigned #PenetrationTesting #CyberSecurity #PrivilegeEscalation #ActiveDirectory #RedTeam #CTF #EthicalHacking #OffensiveSecurity … Learn MoreHack The Box: Signed Machine Walkthrough – Medium Difficulity The post Hack The Box: Signed Machine Walkthrough – Medium Difficulity appeared first on Threatninja.net.