blog
HTB "CPTS Track" writeups
- HTB CPTS Track: Pov (medium)#cpts-track#htb#windows#web#lfi#viewstate-deserialization#runas#sedebugprivilege#windows-privilege-escalationBlack-box Windows box: an LFI in a dev vhost leaks the ASP.NET machineKey, a forged __VIEWSTATE gives RCE as sfitz, a saved PSCredential in connection.xml unlocks alaading, and SeDebugPrivilege is abused to migrate into a SYSTEM process for root.
- HTB CPTS Track: Postman (easy)#cpts-track#htb#linux#redis#ssh-key-injection#password-cracking#webmin#cve-2019-12840#linux-privilege-escalationBlack-box Linux box: an unauthenticated Redis instance lets me write my own SSH key for a foothold, a backed-up encrypted private key cracks to a reused password for user, and Webmin 1.910 (CVE-2019-12840) running as root gives up a root shell.
- HTB CPTS Track: Trick (easy)#cpts-track#htb#linux#web#dns-zone-transfer#sql-injection#lfi#php-filters#smtp-mail-spool-poisoning#fail2ban#bash-suid#path-traversalBlack-box Linux box: a DNS zone transfer leaks hidden vhosts, SQLi and PHP-filter LFI leak creds and the nginx config, mail-log poisoning gives RCE as a user, and a writable fail2ban action escalates to root.
- HTB CPTS Track: Jeeves (medium)#cpts-track#htb#windows#jenkins#groovy-script#keepass#password-cracking#pass-the-hash#alternate-data-streamsBlack-box Windows box: unauthenticated Jenkins gives RCE via the Groovy console, a cracked KeePass database leaks the Administrator NT hash, and root.txt hides in an NTFS alternate data stream.
- HTB CPTS Track: Fluffy (easy)#cpts-track#htb#active-directory#adcs#esc16#shadow-credentials#pkinit#upn-hijack#ntlm-leak#generic-write#windowsAssumed-breach Windows box: NTLM coercion, shadow credentials, and AD CS ESC16 chained to Domain Admin.
no posts match.