Tag: HackTheBox | Youssef Kessentini

Created2026-11-05|HTB Machines|HackTheBox•Windows•Active Directory•Deleted Objects•bloodyAD•SMB•VS Code•Malicious Extension

HTB Medium Windows machine: a domain account that can write to a deleted AD object, a restored user with write access to a VS Code extensions share, and a malicious .vsix that returns a shell as ryan.brooks

MakeSense

Created2026-11-05|HTB Machines|HackTheBox•Linux•Privilege Escalation•WordPress•Stored XSS•CSRF•Client-Side Encryption•Credential Reuse•Webshell

HTB Medium Linux machine: a password leaked in a voice message, a forged client-side-encrypted payload that turns into stored XSS and a new WordPress admin, and root through an OCR service that saves recognized text as a PHP file

VariaType

Created2026-10-14|HTB Machines|HackTheBox•Linux•Command Injection•Path Traversal•CVE-2025-66034•CVE-2024-25082•fontTools•FontForge•Git Leak•Sudo Misconfiguration

HTB Medium Linux machine — credentials from an exposed .git, a fontTools arbitrary file write (CVE-2025-66034) for a webshell, FontForge archive command injection (CVE-2024-25082) to reach steve, and root by overwriting /etc/sudoers through a setuptools path traversal

Reactor

Created2026-10-14|HTB Machines|HackTheBox•Linux•Privilege Escalation•Credential Cracking•CVE-2025-55182•React2Shell•Next.js•Metasploit•Node.js Inspector•Debugger Abuse

HTB Easy Linux machine — unauthenticated RCE in a Next.js app (CVE-2025-55182, React2Shell), an MD5 hash cracked from a SQLite database, and root through a Node.js inspector left open on localhost

DevHub

Created2026-10-14|HTB Machines|HackTheBox•Linux•CVE-2026-23744•MCPJam Inspector•Unauthenticated RCE•JupyterLab•WebSocket•Hardcoded Secrets•Privilege Escalation

HTB Medium Linux machine — unauthenticated RCE in MCPJam Inspector (CVE-2026-23744), a hand-rolled WebSocket to hijack a Jupyter kernel, and root through a hidden admin tool in a root-owned MCP server

CCTV

Created2026-07-11|HTB Machines|HackTheBox•Linux•SQL Injection•CVE-2024-51482•CVE-2025-60787•ZoneMinder•motionEye•Command Injection•Default Creds•Credential Cracking

HTB Easy Linux machine — default creds into ZoneMinder, time-based SQL injection (CVE-2024-51482) to dump password hashes, and root via motionEye command injection (CVE-2025-60787)

WingData

Created2026-06-25|HTB Machines|HackTheBox•Linux•Privilege Escalation•RCE•CVE-2025-47812•CVE-2025-4517•Wing FTP•Null Byte Injection•Tarfile•Password Cracking

HTB Easy Linux machine — Wing FTP RCE via Null Byte Injection (CVE-2025-47812), credential harvesting, and root via Python tarfile symlink bypass (CVE-2025-4517)

Dark Runes

Created2026-06-20|HTB Challenges|HackTheBox•Web•LFI•Brute Force•PDF Injection

HTB Web challenge — Admin registration, 4-digit brute force, and Local File Inclusion via PhantomJS PDF rendering