Tag: Credential Cracking | Youssef Kessentini

Created2026-10-14|HTB Machines|HackTheBox•Linux•Privilege Escalation•Credential Cracking•CVE-2025-55182•React2Shell•Next.js•Metasploit•Node.js Inspector•Debugger Abuse

HTB Easy Linux machine — unauthenticated RCE in a Next.js app (CVE-2025-55182, React2Shell), an MD5 hash cracked from a SQLite database, and root through a Node.js inspector left open on localhost

CCTV

Created2026-07-11|HTB Machines|HackTheBox•Linux•SQL Injection•CVE-2024-51482•CVE-2025-60787•ZoneMinder•motionEye•Command Injection•Default Creds•Credential Cracking

HTB Easy Linux machine — default creds into ZoneMinder, time-based SQL injection (CVE-2024-51482) to dump password hashes, and root via motionEye command injection (CVE-2025-60787)