Posts on: Writeups

---

Consolidated index of 39 OSCP-like HTB Linux boxes — one path per box, the non-obvious steps that decide it, and the exact commands worth memorising. These are edge-case notes, not walkthroughs: every command must be adapted to the target (IPs, vhosts, ports, usernames, payload paths), and the source writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Start with a full TCP scan plus the UDP ports people skip (161, and NFS/mountd on dynamic ports), then fuzz vhosts before directory-brute-forcing the IP root. Treat every credential as a username+password pair and spray it at SSH, su and the application itself before hunting another bug. After landing a shell, run the triad — sudo -l, SUID/capabilities, and pspy/cron/timers — plus ss -tnl for localhost-only services. When an exploit fails, read the application’s own source and config (.git, backups, *.inc.php, JAR/ZIP contents) before assuming the target is patched. Enigma Path: NFS export /srv/nfs/onboarding holds an onboarding PDF with webmail creds → Roundcube mail001 → password reuse to a second mailbox → OpenSTAManager 2.9.8 support portal → www-data → DB hash → haris → OliveTin on 1337 → root.

Eighteen standalone Windows boxes from the OSCP-like list — one intended path each, the non-obvious step that decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, hostname, port, user and payload path must be adapted to the target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Full port scan, then UDP. nmap -sT -p- --min-rate 5000 --max-retries 1 is the baseline; several boxes answer on nothing in the top 1000 (Chatterbox, Arctic) and services hide on UDP (AChat on 9256). Enumerate SMB and RPC before attacking. Null sessions, share listings (smbclient -N -L //IP when smbmap fails), and RID cycling (lookupsids, 1000–1050) often produce the userlist no wordlist would give you. Re-try every credential against SMB, WinRM, RDP, MSSQL and the application itself — including username-format variants (admin vs admin@domain, user vs DOMAIN\user). Then run whoami /priv, check service ACLs and writable service paths before any kernel exploit. Assume Defender and AppLocker. Prefer living-off-the-land, shell_exec over system, staged and encoded payloads; a payload that does nothing is usually AV or .NET-version mismatch, not a broken exploit. Markup Path: Default creds on the MegaShopping login → Order page posts raw XML to /process.php → XXE reads Daniel’s id_rsa → SSH → users-writable job.bat run by a SYSTEM schedule.

The AD half of the OSCP-like HTB list — one path per box, the step that actually decides it, and the exact command worth memorising. These are edge-case notes, not walkthroughs: every IP, domain, user and path must be adapted to your target, and the linked writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Assumed breach vs unauthenticated. Only five boxes hand you credentials at the start — Administrator (olivia:ichliebedich), Certified (judith.mader:judith09), EscapeTwo (rose:KxEPkKe6R8su), Puppy (levi.james:KingofAkron2025!) and Signed (scott:Sm230#C5NatH). For those, the first ten minutes are --shares, BloodHound, certipy find and per-service auth checks — not brute force. Everything else starts with null SMB/RPC, a web bug, or a share. BloodHound before exploitation. Collect with bloodhound-python -c all --zip (or bloodhound-ce-python) and read the Abuse Info of each edge; rights on the domain node show up as GetChanges/GetChangesAll, not as an edge called “DCSync” (Sauna). Every found secret is a reuse test. Fan out nxc smb/ldap/winrm/mssql/ftp with --continue-on-success; a service that fails is not the service that matters (Return: WinRM but no SMB admin; Administrator: FTP but no WinRM for benjamin). Try the actual account name when a config spells it differently (Sauna). ADCS, delegation and time. None of Active/Forest/Sauna/Flight/Return/Blackfield/Cicada/TheFrizz/Administrator/Monteverde exposes a CA — do not burn exam minutes on Certipy there. The ESC paths live in Escape (ESC1), EscapeTwo (ESC4→ESC1) and Certified (ESC9). Clock skew is the single most common time sink: sudo ntpdate <dc fqdn>, expect the VPN to drop, reconnect — but note that AS-REP roasting tolerates hours of skew (Sauna). At-a-glance Box Start Entry technique Key escalation Difficulty Active Unauthenticated GPP cpassword in DFS-R share Kerberoast Administrator Easy Forest Unauthenticated Null RPC → AS-REP WriteDacl → DCSync Easy Sauna Unauthenticated Kerbrute → AS-REP AutoLogon → GetChanges/GetChangesAll Easy Flight Unauthenticated PHP LFI → UNC → NetNTLMv2 Machine TGT (tgtdeleg) → DCSync Hard Return Unauthenticated Printer panel → LDAP cleartext Server Operators sc config Easy Blackfield Unauthenticated Profiles share → AS-REP ForceChangePassword → LSASS → SeBackup Hard Cicada Unauthenticated Guest SMB → HR share → RID brute LDAP description → Backup Operators Easy TheFrizz Unauthenticated Gibbon LMS CVE-2023-45878 Kerberos SSH → GPO abuse Medium Administrator Assumed breach BloodHound ACL chain GenericAll → FTP psafe3 → targeted Kerberoast Medium Monteverde Unauthenticated RPC querydispinfo → spray ADSync LocalDB + mcrypt Medium Escape Unauthenticated SMB PDF → MSSQL Coerce → ESC1 Medium EscapeTwo Assumed breach xlsx → MSSQL sa WriteOwner → shadow creds → ESC4→ESC1 Medium Certified Assumed breach WriteOwner Management group Shadow creds ×2 → ESC9 Medium Puppy Assumed breach HR group → GenericWrite Developers KeePassXC → GenericAll → DPAPI Medium Timelapse Unauthenticated winrm_backup.zip → pfx Certificate WinRM → LAPS Easy Signed Assumed breach SQL login scott Silver ticket → OPENROWSET Medium Active Path: Anonymous SMB on the DFS-R Replication share → Groups.xml cpassword → gpp-decrypt → svc_tgs → Kerberoast (SPN owned by Administrator) → psexec.