Writeups

Security Writeups

CTF writeups, machine walkthroughs, and security challenge solutions. Active machines show approach only — full writeups available after retirement.

Platform

All Hack The Box TryHackMe ThunderCipher

Type

All Types Machines Challenges Sherlocks

Difficulty

easy medium hard insane

Active Machines

approach only

hack the-boxmediumLinuxmachine active

Stream - HackTheBox

An exposed Spring Boot Actuator heap dump

Blind XXE for arbitary file read

hack the-boxmediumLinuxmachine active

Layover - HackTheBox

Enabling wireless network and host discovery

Capturing Credentials via Passive Sniffing

hack the-boxmediumLinux active

MakeSense

Enumerated target system

Found sense-making vulnerability

hack the-boxmediumLinux active

Connected

Enumerated connected services

Found service vulnerability

hack the-boxmediumWindows active

Cohort

AD enumeration with BloodHound

Identified cohort group misconfiguration

hack the-boxmediumLinux active

BedSide

Enumerated target with nmap

Discovered web application vulnerability

Retired Writeups

19 available

hack the-boxmediumLinux retired

SmartHire

MLflow Default Credentials

CVE-2024-37054 -- pickle deserialization RCE via malicious PyFunc model

hack the-boxmediumLinux retired

Silentium

VHost fuzzing

CVE-2025-58434 for account takeover

hack the-boxmediumLinux retired

DevHub

MCPJam Inspector Exposure -- Unauthenticated MCP inspector

CVE-2026-23744 -- Unauthenticated RCE via attacker-controlled command/args in /api/mcp/connect

hack the-boxmediumLinux retired

Sorcery

Nmap scan revealed services

Enumerated web application

hack the-boxmediumLinux retired

Snapped

Initial enumeration

Discovered snapshot application

hack the-boxmediumLinux retired

Signed

Scanned target with nmap

Enumerated services

hack the-boxmediumLinux retired

Pterodactyl

Nmap scan revealed services

Enumerated game server panel

hack the-boxmediumWindows retired

Principal

AD enumeration

Identified vulnerable service

hack the-boxmediumLinux retired

Overwatch

Comprehensive enumeration

Identified monitoring system vulnerability

hack the-boxmediumLinux retired

Logging

Initial enumeration

Discovered logging application

hack the-boxmediumLinux retired

Interpreter

Nmap scan revealed services

Enumerated interpreter application

hack the-boxmediumWindows retired

Intelligence

AD enumeration

Identified GPO vulnerability

hack the-boxmediumLinux retired

Guardian

Initial enumeration

Discovered security application

hack the-boxmediumLinux retired

FireFlow

Comprehensive enumeration

Identified workflow engine vulnerability

hack the-boxmediumLinux retired

Eloquia

OAuth Logic Flaw and HTML injection for admin takeover.

CVE-2024-47881 (OpenRefine SQLite `load_extension` RCE).

hack the-boxmediumLinux retired

DevArea

Scanned target with nmap

Enumerated development environment

hack the-boxmediumLinux retired

Conversor

Nmap scan revealed services

Enumerated conversion service

hack the-boxmediumLinux retired

Cobblestone

Initial enumeration

Discovered web application

hack the-boxmediumLinux retired

Breach

Comprehensive enumeration

Identified vulnerable web application