CTF Writeups
HackTheBox and lab walkthroughs with practical exploitation steps.
Focused writeups from boxes and labs I solved, including enumeration flow, exploit path, and privilege escalation notes.
Heist
PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2026-04-04 18:55:23Z) 135/tcp open msrpc …
Access
upoaded .htaccess to bypass filter and got rce and then privesc by kerberoasting and SeManageVolume priv.
Medjed
nmap -p- 192.168.167.127 -Pn -sCV -A --min-rate=20000 Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-03 09:32 EDT Warning: 192.168.167.127 giving up on port because retransmission cap hit (10). Nmap scan …
Slorp
Initial Access with RFI and privesc with scheduled task.
Shenzi
initial access through wordpress and rpivesc with Always install Elevated.
Nickel
exposed api endpoint gave weak creds , privesc with web hosted taking arguments.
Hepet
Initial access with email macro and privesc with PowerUp.
DVR4
PORT STATE SERVICE VERSION 22/tcp open ssh Bitvise WinSSHD 8.48 (FlowSsh 8.48; protocol 2.0; non-commercial use) | ssh-hostkey: | 3072 21:25:f0:53:b4:99:0f:34:de:2d:ca:bc:5d:fe:20:ce (RSA) |_ 384 …
Resourced
└─$ nmap -p- 192.168.139.175 -Pn -sCV -A --min-rate=20000 Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-30 08:50 EDT Nmap scan report for 192.168.139.175 Host is up (0.081s latency). Not shown: 65515 …
Kevin
Web behavior was the main signal here, so I traced each response change before exploitation.
Jacko
This writeup covers the full attack path for Jacko, including enumeration, exploitation, and privilege escalation.
Internal
msfconsole search cve:CVE-2009-3103 use exploit/windows/smb/ms09_050_smb2_negotiate_func_index set RHOSTS set LHOST run
Hutch
initial access thru creds leaked with —users ldap flag and then foothold with webdav cmdshell, privesc with exposed admin creds in laps.
Craft
Initial with macro doc, priesc with lateral movement for better privs.
Authby
21/tcp open ftp zFTPServer 6.0 build 2011-10-17 | ftp-anon: Anonymous FTP login allowed (FTP code 230) | total 9680 | ---------- 1 root root 5610496 Oct 18 2011 zFTPServer.exe | …
Algernon
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit PORT STATE SERVICE VERSION 21/tcp open ftp Microsoft ftpd | ftp-anon: Anonymous FTP login allowed (FTP code 230) | 04-29-20 10:31PM …
vmdak
Initial access through rce exploit and then privesc thorough exposed creds and exposed jenkins interface on local port.
Snookums
21/tcp open ftp vsftpd 3.0.2 | ftp-anon: Anonymous FTP login allowed (FTP code 230) |_Can't get directory listing: TIMEOUT | ftp-syst: | STAT: | FTP server status: | Connected to …