# Joshua

> OSCP+ and OSCP certified

- **URL:** https://hackindex.io/authors/joshua
- **Role:** HackIndex Creator
- **Profiles:** https://github.com/joshuavanderpoll/, https://www.linkedin.com/in/joshuavdpoll/, https://discordapp.com/users/163716828655386624, https://www.youtube.com/@HackIndexIO, https://www.instagram.com/hackindex.io/, https://x.com/hackindexio

> Ik heb slaaptekort want ik slaap te kort ~ GewoonBoef

## Writeups

- [Management Writeup - HackTheBox](https://hackindex.io/writeups/management.md): Exploit WordPress on a subdomain to gain RCE, leverage DNS zone transfer for recon, and abuse sudoers misconfiguration for root escalation.
- [Nexus Writeup - HackTheBox](https://hackindex.io/writeups/nexus.md): SQL injection on a web app leads to credential extraction, enabling SSH access. Privilege escalation via misconfigured Linux permissions yields root.
- [MakeSense Writeup - HackTheBox](https://hackindex.io/writeups/makesense.md): Linear programming attack on a custom XOR-based encryption scheme to recover the flag by solving constraints derived from the cipher's operations.
- [Paperwork Writeup - HackTheBox](https://hackindex.io/writeups/paperwork.md): Exploit a Linux machine by abusing misconfigured services and weak credentials to gain initial access, then escalate privileges through vulnerable SUID binaries.
- [Bedside Writeup - HackTheBox](https://hackindex.io/writeups/bedside.md): Memory forensics challenge using Volatility to analyze a Linux memory dump, extracting artifacts to uncover hidden flags through process and file analysis.
- [DanglingTree Writeup - HackTheBox](https://hackindex.io/writeups/danglingtree.md): Exploit a Windows machine by chaining LDAP enumeration, Kerberoasting, and ACL abuse to escalate privileges and capture the flag.
- [Cohort Writeup - HackTheBox](https://hackindex.io/writeups/cohort.md): Exploit a web app leaking user cohort data to enumerate valid credentials, then leverage misconfigured SSH access to escalate privileges on this easy Linux box.
- [Plant Photographer Writeup - TryHackMe](https://hackindex.io/writeups/plant-photographer.md): Exploit a plant photography web app via SQLi to extract creds, abuse Shoot! tool for RCE, pivot through user flags, and escalate via SUID binary.
- [DevHub Writeup - HackTheBox](https://hackindex.io/writeups/devhub.md): Exploit a Flask SSTI vulnerability in a developer hub app to gain RCE, then escalate privileges via misconfigured sudo or SUID binaries on Linux.
- [Connected Writeup - HackTheBox](https://hackindex.io/writeups/connected.md): Exploit MongoDB misconfiguration with unauthenticated access to enumerate databases and retrieve credentials, ultimately gaining root on an easy Linux box.
- [Checkpoint Writeup - HackTheBox](https://hackindex.io/writeups/checkpoint.md): Windows medium box involving checkpoint security mechanisms, requiring careful enumeration, privilege escalation, and bypassing security controls to gain root access.
- [Nimbus Writeup - HackTheBox](https://hackindex.io/writeups/nimbus.md): Exploiting a cloud misconfiguration in a hard Linux HackTheBox machine involving AWS/cloud enumeration, privilege escalation through misconfigured services.
- [Reactor Writeup - HackTheBox](https://hackindex.io/writeups/reactor.md): Unauthenticated Next.js RCE via React2Shell (CVE-2025-55182), crack a reused hash from the app SQLite database for SSH, then abuse a root Node --inspect debug port for root.
- [PingPong Writeup - HackTheBox](https://hackindex.io/writeups/pingpong.md): Insane Windows box exploiting a ping command injection vulnerability, chaining SSRF and lateral movement techniques to achieve full system compromise.
- [Logging Writeup - HackTheBox](https://hackindex.io/writeups/logging.md): Windows medium box involving log analysis and exploitation of logging mechanisms to gain foothold and escalate privileges through misconfigured services.
- [Publisher Writeup - TryHackMe](https://hackindex.io/writeups/publisher.md): Exploit SUID binary and bypass AppArmor restrictions to escalate privileges on a Linux machine through careful enumeration and profile analysis.
- [Support Writeup - HackTheBox](https://hackindex.io/writeups/support.md): Easy Windows box involving LDAP enumeration, custom binary reverse engineering to extract credentials, and Kerberos resource-based constrained delegation abuse for SYSTEM.
- [Principal Writeup - HackTheBox](https://hackindex.io/writeups/principal.md): Exploiting JWT algorithm confusion and SSTI vulnerabilities on a Linux machine to escalate privileges and capture the flag.
- [Silentium Writeup - HackTheBox](https://hackindex.io/writeups/silentium.md)
- [Garfield Writeup - HackTheBox](https://hackindex.io/writeups/garfield.md)
- [Kobold Writeup - HackTheBox](https://hackindex.io/writeups/kobold.md)
- [DevArea Writeup - HackTheBox](https://hackindex.io/writeups/devarea.md)
- [VariaType - HackTheBox](https://hackindex.io/writeups/variatype.md): PHP type juggling vulnerability exploited via loose comparison to bypass authentication and gain RCE through crafted input manipulation on a Linux web challenge.
- [CCTV Writeup - HackTheBox](https://hackindex.io/writeups/cctv.md)
- [Twiggy Writeup - Proving Grounds](https://hackindex.io/writeups/twiggy.md): Salt-stack CVE-2020-11651 exploitation on Linux target to achieve unauthenticated RCE as root via the SaltStack master service.
- [Vegeta1 Writeup - Proving Grounds](https://hackindex.io/writeups/vegeta1.md): Boot2root Linux box exploiting Webmin vulnerability for initial foothold, then leveraging SUID binary or misconfigurations for root privilege escalation.
- [Stapler Writeup - Proving Grounds](https://hackindex.io/writeups/stapler.md): Exploiting an outdated WordPress installation on a Linux box via SSH enumeration, privilege escalation through a writable bash history and SUID binaries.
- [SoSimple Writeup - Proving Grounds](https://hackindex.io/writeups/sosimple.md): Exploit WordPress plugins for RCE, escalate via sudo misconfiguration and SUID binaries on this Linux box to capture both flags.
- [Potato Writeup - Proving Grounds](https://hackindex.io/writeups/potato.md): Linux box exploiting web app for RCE via PHP, pivoting through user enumeration and sudo misconfiguration for root privilege escalation.
- [Pelican Writeup - Proving Grounds](https://hackindex.io/writeups/pelican.md): Exploited Exhibitor ZooKeeper RCE to gain foothold, then leveraged password reuse via sudo `password` binary to escalate to root.
- [Monitoring Writeup - Proving Grounds](https://hackindex.io/writeups/monitoring.md): Exploiting Nagios XI via authenticated RCE CVE-2019-15949, then escalating privileges using sudo rights to gain root on Linux.
- [InsanityHosting Writeup - Proving Grounds](https://hackindex.io/writeups/insanityhosting.md): Compromise a Linux machine via LFI to log poisoning through SSH, escalate using MySQL running as root to write a SUID shell.
- [Exfiltrated Writeup - Proving Grounds](https://hackindex.io/writeups/exfiltrated.md): Linux box rooted via SQLi authentication bypass in Subrion CMS, exploiting a file upload vulnerability to gain RCE, then leveraging a cronjob for privilege escalation.
- [Gaara Writeup - Proving Grounds](https://hackindex.io/writeups/gaara.md): Boot2root Linux box exploiting weak credentials via FTP enumeration, then escalating privileges using a SUID gdb binary to achieve root access.
- [DC-9 Writeup - Proving Grounds](https://hackindex.io/writeups/dc-9.md): SQL injection reveals creds, port knocking opens SSH, password spraying via knockd leads to root through sudo abuse on a Linux target.
- [ColdBoxEasy Writeup - Proving Grounds](https://hackindex.io/writeups/coldboxeasy.md): Exploit WordPress via user enumeration, brute-force creds, upload PHP reverse shell, then escalate privileges using a writable passwd file.
- [Astronaut Writeup - Proving Grounds](https://hackindex.io/writeups/astronaut.md): Easy Linux box exploiting Grav CMS with CVE-2021-21425 for RCE, then leveraging a SUID `php7.4` binary for privilege escalation to root.
- [Facts Writeup - HackTheBox](https://hackindex.io/writeups/facts.md): Exploit information disclosure on a Linux web challenge by enumerating exposed endpoints to uncover hidden facts and capture the flag.
- [Blackgate Writeup - Proving Grounds](https://hackindex.io/writeups/blackgate.md): Exploited Redis and Lua sandbox escape for RCE, then leveraged a SUID binary vulnerability to escalate privileges to root on this Linux machine.
- [Blogger Writeup - Proving Grounds](https://hackindex.io/writeups/blogger.md): Exploit WordPress plugin vulnerability on a hidden subdomain, escalate via writable Docker-related files to root on this Easy Linux box.
- [Amaterasu Writeup - Proving Grounds](https://hackindex.io/writeups/amaterasu.md): Exploit Flask debug RCE on port 5000, enumerate SMB-like file API, upload reverse shell, then abuse writable /etc/passwd for root escalation.
- [WingData Writeup - HackTheBox](https://hackindex.io/writeups/wingdata.md): Exploiting a Windows machine via exposed data in a web app, leveraging SQL injection and weak credentials to gain a foothold and escalate privileges.
- [TwoMillion Writeup - HackTheBox](https://hackindex.io/writeups/twomillion.md): Exploit an invite code API flaw to register, abuse command injection in VPN generation, then leverage CVE-2023-0386 OverlayFS for root escalation.
- [Soulmate Writeup - HackTheBox](https://hackindex.io/writeups/soulmate.md): Exploit a Node.js app with SSTI in Handlebars and privilege escalation via a misconfigured SUID binary on an Easy Linux HackTheBox machine.
- [Pterodactyl Writeup - HackTheBox](https://hackindex.io/writeups/pterodactyl.md): Exploit a Pterodactyl game panel via subdomain enumeration, command injection, and privilege escalation to root on this medium Linux box.
- [Interpreter Writeup - HackTheBox](https://hackindex.io/writeups/interpreter.md): Reverse engineer a custom bytecode interpreter binary, analyze its instruction set, and craft malicious bytecode to achieve RCE on a Linux target.
- [Expressway Writeup - HackTheBox](https://hackindex.io/writeups/expressway.md): Express.js app vulnerable to prototype pollution via query parameters, leading to RCE through crafted payloads to bypass filters and gain a shell.
- [Eighteen Writeup - HackTheBox](https://hackindex.io/writeups/eighteen.md): Exploit a vulnerable web app on a Windows box by discovering hidden endpoints, leveraging SQL injection, and escalating privileges to root via misconfigured services.
- [Editor Writeup - HackTheBox](https://hackindex.io/writeups/editor.md): Linux box exploiting Overleaf-based file upload vulnerability to gain RCE, then leveraging a misconfigured sudo privilege for root escalation.
- [Conversor Writeup - HackTheBox](https://hackindex.io/writeups/conversor.md): Simple Linux box exploiting a unit converter web app with SSRF to access internal services, leading to credential discovery and privilege escalation.
- [CodePartTwo Writeup - HackTheBox](https://hackindex.io/writeups/codeparttwo.md): Exploit a second-stage code execution challenge on Linux by analyzing decompiled logic, crafting input to bypass checks, and achieving shell access.
- [Cap Writeup - HackTheBox](https://hackindex.io/writeups/cap.md): IDOR vulnerability exposes PCAP file containing FTP credentials. Lateral movement via SSH, then privilege escalation using Python's cap_setuid capability.
- [MonitorsFour Writeup - HackTheBox](https://hackindex.io/writeups/monitorsfour.md): SQL injection in Cacti leads to RCE, followed by port forwarding and privilege escalation techniques to fully compromise this Windows machine.

## Articles

- [Hardened I2P Eepsite with i2pd](https://hackindex.io/blog/hardened-i2p-eepsite-i2pd.md): Host a hardened I2P eepsite with i2pd: a minimal i2pd.conf, one server tunnel, Nginx on loopback, firewall rules, and reading the b32 address.
- [Generate a Vanity I2P Address](https://hackindex.io/blog/vanity-i2p-address-vain.md): Generate a vanity I2P address with vain from i2pd-tools: grind a b32 prefix, install the keys under i2pd, and confirm with keyinfo.
- [Hardened Onion Service on Ubuntu](https://hackindex.io/blog/hardened-onion-service-ubuntu.md): Set up a hardened onion service on Ubuntu or Debian with Tor, Nginx, PHP-FPM, egress lockdown and leak testing before you publish.
- [Generate a Vanity Onion Address](https://hackindex.io/blog/vanity-onion-address-mkp224o.md): Generate a vanity onion address with mkp224o: build the tool, search a prefix, and install the v3 key into your Tor service.
- [Run Multiple Onion Services on One Host](https://hackindex.io/blog/multiple-onion-services.md): Run multiple onion services from one Tor daemon: separate HiddenServiceDir blocks, per-site Nginx vhosts, and a client-authorized admin onion.
- [Set the Onion-Location Header](https://hackindex.io/blog/onion-location-header.md): Set the Onion-Location header in Nginx or a meta tag so Tor Browser offers your onion site to clearnet visitors automatically.
- [SSH Over an Onion Service](https://hackindex.io/blog/ssh-over-onion.md): Reach SSH over an onion service: bind sshd to loopback, add a HiddenServicePort, and connect with torsocks or an ssh ProxyCommand.

## Research

- [Broken Access Control in AI OpenRouter Gateway: CVE Research](https://hackindex.io/research/broken-access-control-in-ai-openrouter-gateway.md): A Filament gateway documents a config option to lock down its admin UI, but nothing in the code ever reads it. Any authenticated panel user reaches the full gateway: API tokens, system prompts, model settings and telemetry. Tracked as GHSA-57hh-5c98-83r8.
- [Unauthenticated Settings Overwrite in WooCommerce Multistore: CVE Research](https://hackindex.io/research/unauthenticated-settings-overwrite-woocommerce-multistore.md): Exploit WooCommerce Multistore 5.4.7 unauth settings overwrite via curl POST to admin-ajax.php. Fake nonce, stock zeroing, SQLi via predictable key=1
- [Infinite Loop svg2pdf.js CSS Selectors: CVE Research](https://hackindex.io/research/infinite-loop-svg2pdf-selectors-unbounded-splitting.md): svg2pdf.js 2.7.0 and earlier: an empty quoted string in a CSS selector triggers an unrecoverable infinite loop (CWE-835). Analysis, PoC and patch.
- [Stored XSS Filament Comments: CVE Research (CVE-2026-90943)](https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering.md): Stored XSS filament comments: unescaped HTML rendering lets any user execute JavaScript in admin sessions. PoC and fix included.
- [Picture in Picture Adware: The Chrome Tab Hijack](https://hackindex.io/research/picture-in-picture-adware.md): How a 200,000-user Chrome extension turned into Picture in Picture adware: a hidden tab on every update, traced end to end with IOCs.
- [ModHeader Malware: Inside the Chrome Spyware Google Removed](https://hackindex.io/research/modheader-malware-chrome-spyware.md): This ModHeader malware analysis reverses the Chrome extension Google pulled and uncovers dormant, encrypted domain-harvesting spyware. Full teardown inside.