Byte JMP

#easy

6 posts

Heist: Cisco Config Credential Reuse to Firefox Credential Leak
◆

Heist: Cisco Config Credential Reuse to Firefox Credential Leak

Hack The Box write-up for the Heist machine. A support portal with guest access exposes a Cisco router configuration containing encrypted credentials. Cracking and decoding recovers three passwords, one of which maps to a Windows account via password spraying. RID brute force reveals additional users and a second valid credential pair lands WinRM as Chase. The Mozilla Maintenance Service log leaks the Administrator password in a command line argument, completing the box.

—9 min read
ServMon: NVMS-1000 Directory Traversal to NSClient++ RCE
◆

ServMon: NVMS-1000 Directory Traversal to NSClient++ RCE

Hack The Box write-up for the ServMon machine. Anonymous FTP exposes internal notes pointing to a password file on a user's desktop, a directory traversal in NVMS-1000 reads the file remotely, password spraying lands SSH as Nadine, and authenticated RCE against NSClient++ through an SSH tunnel escalates to SYSTEM.

—11 min read
Timelapse: PFX Cracking to LAPS
◆

Timelapse: PFX Cracking to LAPS

Hack The Box write-up for the Timelapse machine. Anonymous SMB exposes a password-protected WinRM certificate backup, cracked to gain a foothold over TLS, PowerShell console history leaks a service account, and LAPS_Readers membership hands over the local Administrator password.

—11 min read
Sauna: AS-REP Roasting to DCSync
◆

Sauna: AS-REP Roasting to DCSync

Hack The Box write-up for the Sauna machine. Employee names from a website feed Kerberos user enumeration, AS-REP roasting yields credentials, autologon secrets pivot to a service account with DCSync rights, and pass-the-hash completes the domain compromise.

—12 min read
Return: LDAP Credential Capture to Server Operators Abuse
◆

Return: LDAP Credential Capture to Server Operators Abuse

Hack The Box write-up for the Return machine. LDAP credential capture via printer admin panel, WinRM access, and privilege escalation abusing the Server Operators group.

—6 min read
Sense: Authenticated RCE on pfSense
◆

Sense: Authenticated RCE on pfSense

Hack The Box write-up for the Sense machine. Credential discovery via exposed text files leads to authenticated command injection on pfSense 2.1.3, resulting in root shell access.

—9 min read