Tag: Linux | Youssef Kessentini — Reverse Koat Shell

Created2026-11-05|HTB Machines|HackTheBox•Linux•Privilege Escalation•WordPress•Stored XSS•CSRF•Client-Side Encryption•Credential Reuse•Webshell

HTB Medium Linux machine: a password leaked in a voice message, a forged client-side-encrypted payload that turns into stored XSS and a new WordPress admin, and root through an OCR service that saves recognized text as a PHP file

VariaType

Created2026-10-14|HTB Machines|HackTheBox•Linux•Command Injection•Path Traversal•CVE-2025-66034•CVE-2024-25082•fontTools•FontForge•Git Leak•Sudo Misconfiguration

HTB Medium Linux machine — credentials from an exposed .git, a fontTools arbitrary file write (CVE-2025-66034) for a webshell, FontForge archive command injection (CVE-2024-25082) to reach steve, and root by overwriting /etc/sudoers through a setuptools path traversal

Reactor

Created2026-10-14|HTB Machines|HackTheBox•Linux•Privilege Escalation•Credential Cracking•CVE-2025-55182•React2Shell•Next.js•Metasploit•Node.js Inspector•Debugger Abuse

HTB Easy Linux machine — unauthenticated RCE in a Next.js app (CVE-2025-55182, React2Shell), an MD5 hash cracked from a SQLite database, and root through a Node.js inspector left open on localhost

DevHub

Created2026-10-14|HTB Machines|HackTheBox•Linux•CVE-2026-23744•MCPJam Inspector•Unauthenticated RCE•JupyterLab•WebSocket•Hardcoded Secrets•Privilege Escalation

HTB Medium Linux machine — unauthenticated RCE in MCPJam Inspector (CVE-2026-23744), a hand-rolled WebSocket to hijack a Jupyter kernel, and root through a hidden admin tool in a root-owned MCP server

CCTV

Created2026-07-11|HTB Machines|HackTheBox•Linux•SQL Injection•CVE-2024-51482•CVE-2025-60787•ZoneMinder•motionEye•Command Injection•Default Creds•Credential Cracking

HTB Easy Linux machine — default creds into ZoneMinder, time-based SQL injection (CVE-2024-51482) to dump password hashes, and root via motionEye command injection (CVE-2025-60787)

WingData

Created2026-06-25|HTB Machines|HackTheBox•Linux•Privilege Escalation•RCE•CVE-2025-47812•CVE-2025-4517•Wing FTP•Null Byte Injection•Tarfile•Password Cracking

HTB Easy Linux machine — Wing FTP RCE via Null Byte Injection (CVE-2025-47812), credential harvesting, and root via Python tarfile symlink bypass (CVE-2025-4517)