Mohammad Meraj

HackTheBox Hard Linux

Ten Writeup - HackTheBox

Exploiting a Node.js app via prototype pollution and SSRF to gain RCE, then escalating privileges through a misconfigured service on a Hard Linux HTB box.

ssrf prototype-pollution

Sep 11, 2026

HackTheBox Medium Windows

Silo Writeup - HackTheBox

Exploit Oracle DB on Windows via ODAT for RCE, upload a web shell, then leverage Oracle SYSDBA privileges to escalate and retrieve flags.

webshell

Sep 11, 2026

HackTheBox Easy Linux

Horizontall Writeup - HackTheBox

Exploit Strapi CMS RCE on a subdomain, gain shell, then pivot via SSH tunneling to attack a local Laravel app for root.

deserialization cve-2019-19609

Sep 11, 2026

HackTheBox Hard Windows

Conceal Writeup - HackTheBox

IKE/IPSec enumeration to establish VPN tunnel, then exploiting FTP upload to IIS webroot for RCE via ASP shell, escalating via SeImpersonatePrivilege.

file-upload webshell

Sep 11, 2026

HackTheBox Easy Windows

Love Writeup - HackTheBox

Exploited a Windows machine via SSRF to leak VOTD app credentials, then used a file upload shell to gain access and abused AlwaysInstallElevated for privesc.

ssrf file-upload webshell

Sep 11, 2026

HackTheBox Easy Linux

Frolic Writeup - HackTheBox

Exploit a PlaySMS RCE vulnerability after decoding OOK/Brainfuck/Base64 creds, then escalate via SUID rop binary with ret2libc.

buffer-overflow privilege-escalation suid base64 +1

Sep 11, 2026

HackTheBox Easy Windows

Legacy Writeup - HackTheBox

Exploiting MS08-067 and MS17-010 vulnerabilities on an unpatched Windows XP machine to gain SYSTEM-level access without user interaction.

eternalblue cve-2008-4250 cve-2017-0143

Sep 11, 2026

HackTheBox Medium Linux

Ophiuchi Writeup - HackTheBox

YAML deserialization flaw exploited via SnakeYAML to gain foothold, then abusing WASM/bash script path hijacking for privilege escalation on Linux.

deserialization reverse-engineering privilege-escalation sudo-misconfiguration

Sep 11, 2026

HackTheBox Linux Easy

OpenAdmin Writeup - HackTheBox

Exploit OpenNetAdmin RCE to gain initial access, pivot through internal web configs for credentials, then escalate via nano GTFOBins sudo misconfiguration.

webshell rce opennetadmin privilege-escalation +3

Sep 11, 2026

HackTheBox Insane Windows

Anubis Writeup - HackTheBox

Insane Windows box involving SSRF, certificate services abuse, ADCS ESC1, and Shadow Credentials to escalate through Active Directory.

ssrf active-directory adcs shadow-credentials +2

Aug 17, 2026

HackTheBox Easy Linux

FriendZone Writeup - HackTheBox

SMB enumeration reveals credentials and DNS zones. Exploiting LFI with PHP injection leads to a shell, then Python library hijacking for root.

lfi smb dns-zone-transfer privilege-escalation +2

Aug 17, 2026

HackTheBox Medium Windows

Chatterbox Writeup - HackTheBox

Windows box exploiting Achat buffer overflow for initial foothold, then abusing weak file permissions and stored credentials for privilege escalation.

buffer-overflow eternalblue achat privilege-escalation +2

Aug 17, 2026

HackTheBox Easy Linux

Delivery Writeup - HackTheBox

Exploit an open MatterMost server and helpdesk ticket email trick to gain internal credentials, then crack a bcrypt hash using custom rules for root.

mattermost privilege-escalation hash-cracking osint

Aug 17, 2026

HackTheBox Medium Linux

Mango Writeup - HackTheBox

Linux box exploiting NoSQL injection to bypass MongoDB login, SSH with harvested credentials, then privilege escalation via SUID jjs binary.

sql-injection nosql-injection ssh mongodb +3

Aug 17, 2026

HackTheBox Easy Linux

Doctor Writeup - HackTheBox

Exploit SSTI in Doctor's messaging app via log poisoning, gain RCE as web user, then escalate via Splunk Universal Forwarder credentials.

ssti log-poisoning rce splunk +1

Aug 17, 2026

HackTheBox Insane Windows

APT Writeup - HackTheBox

Insane Windows box involving IPv6 enumeration, RPC abuse, dumping AD secrets via NTDS, and leveraging historical credential reuse to gain SYSTEM.

active-directory ntds-dump rpc-abuse ipv6-enumeration +1

Aug 17, 2026

HackTheBox

Blocky Writeup - HackTheBox

Exploit a Minecraft server's exposed plugin JAR containing hardcoded credentials to gain SSH access and escalate to root via sudo misconfiguration.

reverse-engineering wordpress ssh privilege-escalation +2

Aug 17, 2026

HackTheBox Medium Windows

Bastard Writeup - HackTheBox

Windows machine exploited via Drupal RCE (CVE-2018-7600), followed by privilege escalation using MS15-051 kernel exploit to gain SYSTEM access.

rce drupal privilege-escalation kernel-exploit +3

Aug 17, 2026

HackTheBox Easy Linux

Bank Writeup - HackTheBox

Exploit SQL injection and LFI on a Linux web server, upload a malicious file for RCE, then escalate privileges to root via SUID binary abuse.

sql-injection lfi file-upload webshell +3

Aug 17, 2026

HackTheBox Medium Windows

SecNotes Writeup - HackTheBox

Exploit second-order SQLi to steal credentials, abuse a SMB share to upload a PHP webshell, then escape WSL to escalate to SYSTEM.

sql-injection file-upload webshell smb +1

Aug 17, 2026

HackTheBox Easy Linux

Beep Writeup - HackTheBox

Exploit LFI via Elastix/FreePBX to leak credentials, then SSH as root using default voip creds or shellshock for easy pwn.

sql-injection lfi xss

Aug 17, 2026

HackTheBox Easy Windows

Bounty Writeup - HackTheBox

Windows IIS box exploited via malicious web.config upload for RCE, then escalated to SYSTEM using token impersonation with Metasploit.

file-upload webshell token-impersonation iis +1

Aug 6, 2026

HackTheBox Easy Windows

Devel Writeup - HackTheBox

Exploit anonymous FTP write access on IIS to upload an ASPX web shell, then escalate privileges via MS11-046 kernel exploit on Windows.

webshell iis ftp privilege-escalation +1

Aug 6, 2026

HackTheBox Medium Linux

Pit Writeup - HackTheBox

SNMP enumeration reveals hidden vhosts and CockpitCMS credentials. Exploits lead to RCE via file upload, then SNMP-triggered script for root.

file-upload webshell rce cockpit +4

Aug 6, 2026

HackTheBox Easy Windows

Jerry Writeup - HackTheBox

Exploit default Tomcat credentials to upload a malicious WAR file, gaining a shell as SYSTEM on this beginner-friendly Windows machine.

tomcat privilege-escalation default-credentials

Aug 6, 2026

HackTheBox Easy Linux

Armageddon Writeup - HackTheBox

Exploit Drupalgeddon2 RCE on a Drupal site, crack harvested MySQL creds, then abuse dirty_sock via snap for root escalation.

webshell rce drupal mysql +4

Aug 4, 2026

HackTheBox Medium Windows

Intelligence Writeup - HackTheBox

Active Directory box involving PDF metadata extraction, LDAP enumeration, DNS poisoning, and Kerberos abuse to escalate privileges on a Windows domain.

active-directory bloodhound default-credentials password-cracking

Aug 4, 2026

HackTheBox Hard Windows

Object Writeup - HackTheBox

Exploit Jenkins via firewall bypass, extract credentials, abuse Active Directory delegation and ACL misconfigurations to escalate privileges on Windows.

active-directory kerberoasting bloodhound jenkins +3

Aug 3, 2026

HackTheBox Insane Linux

Brainfuck Writeup - HackTheBox

Insane Linux box involving RSA key exploitation, SMTP enumeration, WordPress vulnerabilities, and complex privilege escalation techniques.

authentication-bypass cryptography wordpress smtp +1

Jul 31, 2026

HackTheBox Hard Windows

Blackfield Writeup - HackTheBox

Active Directory exploitation via AS-REP roasting, SMB enumeration, BloodHound analysis, ForceChangePassword abuse, and SeBackupPrivilege for NTDS.dit extraction.

active-directory as-rep-roasting bloodhound sebackupprivilege +2

Jul 31, 2026

HackTheBox Medium Linux

Jarvis Writeup - HackTheBox

SQL injection on hotel booking site leads to RCE via SQLMap's file write. Escalate through command injection in a script and sudo abuse of systemctl.

sql-injection command-injection lfi privilege-escalation +4

Jul 31, 2026 • 3 min read

HackTheBox Medium Linux

Magic Writeup - HackTheBox

SQL injection auth bypass, webshell upload via image magic bytes, mysqldump credential harvesting, and suid binary PATH hijack for root.

sql-injection file-upload authentication-bypass webshell +4

Jul 30, 2026

HackTheBox Hard Windows

DarkZero Writeup - HackTheBox

Hard Windows box involving advanced exploitation techniques, privilege escalation, and lateral movement through a complex Windows environment.

active-directory adcs privilege-escalation base64 +1

Jul 29, 2026