Planning is an easy Linux machine where web enumeration and a CVE-2024-9264 vulnerability lead to initial access, lateral movement, and full system compromise.
On Nocturnal, an IDOR exposed credentials that unlocked the admin panel and source code. A command injection led to a shell, cracked database hashes enabled SSH access, and exploiting ISPConfig CVE-2023-46818 provided root.
Cat is a medium-difficulty Linux machine featuring a custom PHP web application vulnerable to XSS, which allows cookie hijacking and privilege escalation. A SQL injection in a SQLite database enables remote code execution and access to internal logs, which leak plaintext credentials. These are used to access a vulnerable Gitea instance (CVE-2024-6886), ultimately leading to the discovery of root credentials in a private repository.
Titanic is an easy Linux machine with a booking site and a Gitea instance. An arbitrary file read vulnerability allows access to Gitea's SQLite database, leading to cracked SSH credentials. A scheduled script using a vulnerable magick binary (CVE-2024-41817) is exploited for root access.
"Trickster" is a medium-difficulty Linux machine on HackTheBox that challenges you with technologies like Git, MySQL, Docker, and vulnerabilities such as SSTI and CSRF. This write-up covers the key steps and techniques I used to exploit the machine, highlighting the creative enumeration and exploitation required to capture the flags.
