Search for a command to run...
Series
Writeups for all my solves in HTB
Reconnaissance: An ssh and no creds lying around in info. So had to switch to UDP. Nmap is very slow with the -sU flag (Terrible with UDP scans ) so I switched to RustScan: A quick search on what runs on port 500. After a little more search I came...
Recon: Found a website at :8000 Dirb returned a /download Downloading app.zip. We found js2py in requirement (its vulnerable !!) Now for js2py I found an exploit : Github Setup a netcat at 4444 and make sure to modify IP to your VPN. import js2p...
Enumeration gave us a website at wiki.editorial.htb The version for this was clearly visible: Searching around I found an exploit : CVE-2025-24893 Following the instructions I got the shell. Now came the hardest part finding the hibernate.xml file...
Enumeration: Webpage: I used a top 10000 wordlist with ffuf. I obtained a grafana page with htb. I added this to my /etc/hosts After checking the version I found CVE-2024-9264 Now executing the exploit: Make sure to keep the netcat running on a ...
Writeup for Outbound machine - 27/7/2025
Enumeration: We find a python code editor interestingly: print(locals()) gave me the following output: print(globals()) revealed a lot of details too ,but nothing interesting except a few functions. I switched to burp and ran the run_code function...
