CTF Writeups
HackTheBox and lab walkthroughs with practical exploitation steps.
Focused writeups from boxes and labs I solved, including enumeration flow, exploit path, and privilege escalation notes.
Levram
ORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 256 b9:bc:8f:01:3f:85:5d:f9:5c:d9:fb:b6:15:a0:1e:74 (ECDSA) |_ 256 …
Hub
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0) | ssh-hostkey: | 3072 c9:c3:da:15:28:3b:f1:f8:9a:36:df:4d:36:6b:a7:44 (RSA) | 256 …
Extplorer
easy php shell esc privs with exposed pass in config and disk perm for privesc.
Crane
Web behavior was the main signal here, so I traced each response change before exploitation.
Codo
default creds on web portal —> file upload —> exposed creds.
Cockpit
This writeup covers the full attack path for Cockpit, including enumeration, exploitation, and privilege escalation.
Clue
This writeup covers the full attack path for Clue, including enumeration, exploitation, and privilege escalation.
Boolean
bypassed acc confirmation + LFi, access with ssh and priv esc with ssh.
BlackGate
PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.3p1 Ubuntu 1ubuntu0.1 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 37:21:14:3e:23:e5:13:40:20:05:f9:79:e0:82:0b:09 (RSA) | 256 …
Astronaut
22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 98:4e:5d:e1:e6:97:29:6f:d9:e0:d4:82:a8:f6:4f:3f (RSA) | 256 …
Twiggy
Found a exposed api endpoint, which was using an outdated salt version that had an RCE vuln associated w it.
Pelican
Initial access via ui and then priv esc with sudo -l process dump.
Exfiltrated
Not shown: 65533 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.2p1 Ubuntu 4ubuntu0.2 (Ubuntu Linux; protocol 2.0) | ssh-hostkey: | 3072 …
Facts
└─$ nmap -sCV -A --min-rate=20000 facts.htb Starting Nmap 7.95 ( https://nmap.org ) at 2026-03-10 06:52 EDT Nmap scan report for facts.htb (10.129.4.247) Host is up (0.10s latency). Not shown: …
WingData
Host is up (0.11s latency). Not shown: 998 filtered tcp ports (no-response) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u7 (protocol 2.0) | ssh-hostkey: | 256 …
Pirate
As is common in real life pentests, you will start the Pirate box with credentials for the following account pentest / p3nt3st2025!&
CCTV
timebased sqli gave ssh creds, anbd then rce via public exploit.
StreamIO
This writeup covers the full attack path for StreamIO, including enumeration, exploitation, and privilege escalation.