Writeups

MOST RECENT

Vault – OffSec Practice Writeup

We abuse a guest-writable SMB share to plant a malicious `.url` icon file that coerces a NetNTLMv2 hash from user `anirudh`, crack it offline, then weaponize `SeRestorePrivilege` with the Utilman.exe logon-screen hijack to execute as SYSTEM on the domain controller.

Access – OffSec Practice Writeup

We bypass an upload blacklist with a malicious `.htaccess` extension mapping for RCE, Kerberoast the `svc_mssql` service account and crack its TGS offline, pivot via `RunasCs`, then abuse `SeManageVolumePrivilege` to rewrite `C:\Windows` ACLs and DLL-hijack the print spooler for `NT AUTHORITY\SYSTEM`.

GoodGames – OffSec Practice Writeup

We exploit SQL injection on the login portal to harvest administrative credentials, leverage Server-Side Template Injection (SSTI) in an internal administration panel to obtain a root shell inside a Docker container, and escalate to full host root by abusing a shared volume mount to inject an SUID bash binary.

Pelican – OffSec Practice Writeup

We discover an exposed Exhibitor for ZooKeeper management interface and exploit an unauthenticated remote command injection vulnerability (CVE-2019-5029) to gain initial access, then abuse NOPASSWD sudo rights on gcore to dump the memory of a background password-store process and extract the root password.

Sunday – HTB writeup

We enumerate valid usernames via the legacy Finger protocol, obtain initial access through weak SSH credentials, harvest password hashes from an exposed shadow backup to crack credentials for lateral movement, and escalate privileges to root by abusing sudo permissions on wget via askpass execution.

Pilgrimage – HTB writeup

We discover an exposed Git repository to inspect backend source code, leverage an arbitrary file read vulnerability in ImageMagick (CVE-2022-44268) to extract an SQLite database containing user credentials, and escalate privileges by exploiting a path traversal flaw in an automated Binwalk scanner (CVE-2022-4510) to obtain a root shell.