writeups
Authority HTB: Ansible vault secrets on a guest SMB share, a PWM instance in configuration mode that hands over an LDAP bind in cleartext, and ESC1 through a machine account we add ourselves. htb Voleur HTB: Kerberos-only auth, a cracked Excel sheet leaking service account passwords, targeted Kerberoasting, a restored deleted user whose DPAPI credentials unlock the next account, and an NTDS backup reached through WSL. htb Pov HTB: an LFI on an ASP.NET file parameter leaks web.config and its machine keys, a ViewState deserialization gives RCE, a saved PSCredential unlocks the next user, and SeDebugPrivilege gets migrated into a SYSTEM process. htb Postman HTB: an unauthenticated Redis lets me write an SSH key for RCE as redis, linpeas finds Matt's encrypted id_rsa which cracks to a password, then a Webmin 1.910 packageup RCE gives root. htb Trick HTB: a DNS zone transfer leaks a payroll vhost, SQL injection with FILE privilege reads files off disk, then LFI plus Nginx log poisoning on a second vhost gives a shell as michael, and a sudo fail2ban action hijack finishes it as root. htb Jeeves HTB: an unauthenticated Jenkins Script Console for RCE, then SeImpersonatePrivilege into SYSTEM with JuicyPotato, and a root flag hidden in an alternate data stream. htb TombWatcher HTB: targeted Kerberoasting, a gMSA password read, WriteOwner abuse and a resurrected cert_admin for ADCS ESC15. htb Media HTB: an .asx playlist that leaks an NTLM hash, a directory junction into the web root, and GodPotato. htb Administrator HTB: a password reset chain, a Password Safe backup over FTP, Kerberoasting and DCSync. htb Fluffy HTB: SMB write access, CVE-2025-24071, shadow credentials and ADCS ESC16. htb Hello World My first post :) notes