> For the complete documentation index, see [llms.txt](https://senku01.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://senku01.gitbook.io/blog/hack-the-box.md).
# Hack The Box
## π΄ββ οΈ Hack The Box Journey
> "The best way to learn hacking is by doing it."
***
### π My HTB Progress
βοΈ **Total Boxes Solved:** **37**
* π§ **Linux:** 30
* π **Windows:** 7
βοΈ **Completed HTB Tracks:**
* π₯ **Intro to Dante**
* βοΈ **Cloud Track**
* βοΈβ **Synack Red Team SRT** (50%)
βοΈ **Favorite Box:** π§ͺ **Chemistry**
***
### π Achievements & Badges
#### π **Current Rank: Hacker**
#### π **Earned Badges:**
1οΈβ£ **Script Kiddie**\
2οΈβ£ **Hacker Rank**
***
### π― Why Hack The Box?
Hack The Box is a core part of my **OSCP & OSWE preparation**. It provides:\
πΉ Real-world penetration testing experience\
πΉ Hands-on challenges covering **network, web, API, and Active Directory exploitation**\
πΉ A playground to refine **privilege escalation, enumeration, and post-exploitation** techniques
By solving **challenging boxes**, I continuously refine my **red-teaming mindset** and **attack methodologies**.
***
### π οΈ Boxes Solved with Writeups
Here are some of the boxes Iβve solved on Hack The Box with detailed write-ups:
1. **Curling**
* **Key Vulnerability:** *The password is stored in a file on the **web root**, and the username can be downloaded through a post on the **CMS**. **Modifying the PHP template** gives a shell. A discovered hex dump is reversed to gain a user shell, and a **cron job** running on the system is exploited for **root access**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hack-the-box-curling-writeup-linux-retired-7be2cc094707)
Curling
2. **OpenAdmin**
* **Key Vulnerability:** *Exploitation of an outdated **OpenNetAdmin CMS** instance to gain initial access. **Database credentials** found during enumeration are reused to move laterally to a low-privileged user, eventually exploiting **sudo misconfiguration** for **root access**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hack-the-box-openadmin-writeup-linux-retired-19da037958b1)
Open Admin
3. **Networked**
* **Key Vulnerability:** *Exploitation of a **file upload bypass** leading to **code execution**. Due to **improper sanitization**, a **crontab running as the user** can be exploited to execute commands. The user has privileges to execute a network configuration script, which can be leveraged for **root access**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hack-the-box-networked-writeup-linux-retired-74a7ce795a05)
Networked
4. **Soccer**
* **Key Vulnerability:** *Exploitation of **default credentials** to access a vulnerable version of `Tiny File Manager` (CVE-2021-45010) leading to a **reverse shell**. Subsequent enumeration reveals a subdomain vulnerable to **blind SQL injection** via websockets. **SSH credentials** are dumped, and by exploiting the **doas** binary with the **SUID bit**, a **root shell** is spawned.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hack-the-box-soccer-writeup-linux-retired-35a4823c4747)
Soccer
5. **Help**
* **Key Vulnerability:** *GraphQL endpoint enumeration that retrieves credentials for a HelpDesk software, which is vulnerable to **blind SQL injection**. This leads to an **SSH login** password. Alternatively, **unauthenticated arbitrary file upload** allows for **Remote Code Execution (RCE)**. Finally, a **vulnerable kernel** is exploited to gain **root access**.*.
* π Read [Write-up](< https://medium.com/@vignesh6872610/hack-the-box-help-linux-retired-71e401de2fa5>)
Help
6. **UpDown**
* **Key Vulnerability:** *Discovery of a hidden **`.git` directory** revealing the source code of the `dev` subdomain, which is accessible only with a special HTTP header. File uploads to this subdomain result in **RCE** via the `phar://` PHP wrapper. Code injection into a **SUID Python script** is used to obtain a shell as the `developer` user, who can run `easy_install` with `sudo` (without a password), ultimately escalating to **root**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hack-the-box-updown-retired-linux-5e0a9f6ec84e)
UpDown
7. **Busqueda**
* **Key Vulnerability:** *Exploitation of a **command injection vulnerability** in a Python module to gain user-level access. Privilege escalation to **root** occurs after finding **credentials in a Git config file** and leveraging a **system checkup script** with root privileges. Exploiting a **relative path reference** grants **Remote Code Execution (RCE)** with root privileges.*.
* π Read[ Write-up](https://medium.com/@vignesh6872610/hack-the-box-busqueda-write-up-retired-linux-2f572f4ae0d6)
9. **CAP**
* **Key Vulnerability:** *Exploitation of **Insecure Direct Object Reference (IDOR)** allowing access to another userβs network capture. The capture contains **plaintext credentials**, which are used to gain foothold. A **Linux capability** is exploited to escalate to **root**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/cracking-the-htb-cap-box-a-step-by-step-walkthrough-0b08a4fff3f9)
Cap
10. **BoardLight**
* **Key Vulnerability:** *Exploitation of a **Dolibarr instance** vulnerable to* [*CVE-2023-30253*](https://nvd.nist.gov/vuln/detail/CVE-2023-30253)*, granting access as `www-data`. **Plaintext credentials** from web configuration allow **SSH access**. A **SUID binary** related to `enlightenment` is found and exploited via* [*CVE-2022-37706*](https://nvd.nist.gov/vuln/detail/CVE-2022-37706) *to escalate to **root**.*.
* π Read [Write-up](https://medium.com/@vignesh6872610/hacking-htb-boardlight-from-nmap-to-root-access-dacdc9589a3e)
BoardLight
***
### π Recommended Resources
For anyone preparing for **OSCP/OSWE**, I highly recommend **TJNull's OSCP Preparation Guide**. Itβs a goldmine of learning materials!
π [TJNull's OSCP Preparation Guide](https://docs.google.com/spreadsheets/u/1/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/htmlview)
***