Walkthroughs Category

HTB, PG, and similar machines explained as personal notes: commands, important output, and reasoning, no fluff.

blog
23+ Note
Focus
OSCP · Red Team
Structure
Recon → Exploit
Walkthroughs Category -

Walkthroughs blog

Filters

  • HTB Monitors Walkthrough: Cacti SQLi and Container Escape
    walkthroughs

    HTB Monitors Walkthrough: Cacti SQLi and Container Escape

    Walkthrough of Hack The Box Monitors: SQLi in Cacti (CVE-2020-14295), deserialization in OFBiz (CVE-2020-9496), and container escape via kernel module.

    Discover more Discover more
  • HTB Sink Walkthrough: HTTP Request Smuggling and AWS Privesc
    walkthroughs

    HTB Sink Walkthrough: HTTP Request Smuggling and AWS Privesc

    Hack The Box Sink write-up: HTTP Request Smuggling, CVE-2019-18277, HAProxy, Gunicorn, Gitea, Ligolo-ng, AWS LocalStack, KMS, and Secrets Manager.

    Discover more Discover more
  • HTB Schooled: Stored XSS on Moodle at Root on FreeBSD
    walkthroughs

    HTB Schooled: Stored XSS on Moodle at Root on FreeBSD

    Hack The Box Schooled Write-Up: from Stored XSS on Moodle to webshell, MySQL credentials and privilege escalation to root on FreeBSD via pkg.

    Discover more Discover more
  • HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation
    walkthroughs

    HTB Mango Walkthrough: NoSQL Injection and Privilege Escalation

    Full HTB Mango walkthrough: NoSQL injection login bypass on MongoDB, credential extraction with $regex, and privilege escalation via SUID on jjs.

    Discover more Discover more
  • HTB Unattended Walkthrough: NGINX Alias ​​Bug and Root via LUKS
    walkthroughs

    HTB Unattended Walkthrough: NGINX Alias ​​Bug and Root via LUKS

    Hack The Box Unattended full writeup: NGINX alias bug, double SQL injection, LFI, session poisoning, cron poisoning and privilege escalation to root.

    Discover more Discover more
  • TryHackMe Bolt: Complete Walkthrough (RCE on Bolt CMS)
    walkthroughs

    TryHackMe Bolt: Complete Walkthrough (RCE on Bolt CMS)

    Write-Up of TryHackMe's Bolt machine: enumeration, credential discovery, RCE authenticated to Bolt CMS via session hijacking and privesc to root.

    Discover more Discover more
  • HTB Help Walkthrough: GraphQL and File Upload HelpDeskZ
    walkthroughs

    HTB Help Walkthrough: GraphQL and File Upload HelpDeskZ

    Complete Hack The Box: Help write-up. GraphQL enumeration, bypass file upload to HelpDeskZ with vulnerable PHP code analysis, privesc kernel to root.

    Discover more Discover more
  • HTB Falafel Walkthrough: SQLi, PHP Type Juggling and Privesc
    walkthroughs

    HTB Falafel Walkthrough: SQLi, PHP Type Juggling and Privesc

    Hack The Box's Falafel Machine Write-Up: User Enumeration, Blind SQL Injection, PHP Login Bypass, RCE Upload, and Linux Privilege Escalation.

    Discover more Discover more
  • HTB Shibuya Walkthrough: WIM, RemotePotato0 and ADCS ESC1
    walkthroughs

    HTB Shibuya Walkthrough: WIM, RemotePotato0 and ADCS ESC1

    Hack The Box Shibuya Write-up: Enumerate users via Kerberos, extract NTLM hashes from WIM backups, and leverage RemotePotato0 and ADCS ESC1 up to Domain Admin.

    Discover more Discover more
  • HTB Redelegate Walkthrough: SeEnableDelegationPrivilege
    walkthroughs

    HTB Redelegate Walkthrough: SeEnableDelegationPrivilege

    Complete WriteUp of Hack The Box Redelegate: Anonymous FTP, KeePass, MSSQL, ForceChangePassword, SeEnableDelegationPrivilege, S4U, DCSync and Domain Admin.

    Discover more Discover more
  • HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914
    walkthroughs

    HTB Giddy Walkthrough: SQL Injection and CVE-2016-6914

    Hack The Box Giddy full write-up: SQL Injection, NTLMv2 hash capture, WinRM access, AV Bypass and privilege escalation to SYSTEM via CVE-2016-6914.

    Discover more Discover more
  • HTB Love Walkthrough: SSRF, SQLi Time-Based and Privesc
    walkthroughs

    HTB Love Walkthrough: SSRF, SQLi Time-Based and Privesc

    Write-Up HTB Love, Easy VM: SQLi time-based, NTLM attempt on Responder, SSRF towards 5000, and privesc with AlwaysInstallElevated. Every dead end explained.

    Discover more Discover more
  • HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA)
    walkthroughs

    HTB Eighteen Walkthrough: MSSQL and private BadSuccessor(dMSA)

    WriteUp Hack The Bpx Eighteen: MSSQL impersonation, cracking hash Werkzeug PBKDF2, privilege escalation with BadSuccessor (CVE-2025-53779) on Windows Server 2025

    Discover more Discover more
  • Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc
    walkthroughs

    Voleur HTB: Writeup with Kerberoasting, DPAPI and WSL Privesc

    Voleur's full walkthrough of Hack The Box: targeted Kerberoasting, AD Recycle Bin abuse, DPAPI chaining, and privilege escalation via WSL to Administrator.

    Discover more Discover more
  • HTB Scepter Walkthrough: NFS, ESC9, ESC14 and DCSync
    walkthroughs

    HTB Scepter Walkthrough: NFS, ESC9, ESC14 and DCSync

    Complete WriteUp at Hack The Box Scepter: NFS, PFX/PEM certificates, ADCS ESC9, ESC14, altSecurityIdentities and final DCSync.

    Discover more Discover more
  • HTB Anubis Walkthrough — ASP SSTI, Jamovi RCE and ADCS ESC4
    walkthroughs

    HTB Anubis Walkthrough — ASP SSTI, Jamovi RCE and ADCS ESC4

    Complete walkthrough of Hack The Box Anubis (Insane, Windows): ASP SSTI for shell in Docker, CVE-2021-28079 on Jamovi for foothold on host, and privilege escalation via ADCS ESC4 with GenericAll on certificate template.

    Discover more Discover more
  • HTB Haze Walkthrough: Splunk RCE and AD Attack Chain
    walkthroughs

    HTB Haze Walkthrough: Splunk RCE and AD Attack Chain

    HTB Haze Writeup: CVE-2024-36991 on Splunk, credential decryption with splunksecrets, GMSA abuse, Shadow Credentials on AD and RCE up to SYSTEM.

    Discover more Discover more
  • HTB Search Walkthrough – GMSA, Kerberoast and AD Certificate
    walkthroughs

    HTB Search Walkthrough – GMSA, Kerberoast and AD Certificate

    Complete writeup of HTB Search: foothold via credentials in an image, Kerberoasting, GMSA abuse, and two distinct paths to Domain Admin.

    Discover more Discover more
  • HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization
    walkthroughs

    HTB Scrambled Walkthrough: Silver Ticket and .NET Deserialization

    HTB Scrambled Writeup: Kerberoasting, Silver Ticket on MSSQL and RCE via BinaryFormatter insecure deserialization. Static analysis with dnSpy and ysoserial.net

    Discover more Discover more
  • HTB Sekhmet Walkthrough: Node.js Deserialization, WAF Bypass and DPAPI
    walkthroughs

    HTB Sekhmet Walkthrough: Node.js Deserialization, WAF Bypass and DPAPI

    HTB Sekhmet Insane,WriteUp Complete: insecure deserialization in node-serialize, bypass ModSecurity with Unicode encoding, ZipCrypto, Kerberos on Linux and DPAPI on Active Directory.

    Discover more Discover more
  • HTB ProLab Dante: Full Review 2026 – Is It Worth It?
    walkthroughs

    HTB ProLab Dante: Full Review 2026 – Is It Worth It?

    HTB ProLab Dante review: lab structure, strengths of pivoting, real-world issues with older OSes and unintended CVEs. Who really needs it and when to skip it.

    Discover more Discover more
  • HTB Hathor Walkthrough ITA: AppLocker Bypass, DLL Hijacking and DCSync on Windows Insane
    walkthroughs

    HTB Hathor Walkthrough ITA: AppLocker Bypass, DLL Hijacking and DCSync on Windows Insane

    HTB Hathor Walkthrough: AppLocker Bypass, DLL Hijacking over SMB, Code Signing with a Stolen Certificate, and DCSync Without NTLM. Insane Windows Machine

    Discover more Discover more
  • Osaka Walkthrough – OffSec PG | BOF, ROP Chain & DEP Bypass
    walkthroughs

    Osaka Walkthrough – OffSec PG | BOF, ROP Chain & DEP Bypass

    Walkthrough Osaka – OffSec Proving Grounds: format string → ASLR bypass, ROP chain with VirtualAlloc → DEP bypass, shellcode and SeDebugPrivilege → SYSTEM.

    Discover more Discover more