YPYogesh Peelainexploitnotes.hashnode.dev·18h ago · 8 min readHackTheBox: NeoVault Challenge WriteupSummary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patch00
LVLong Voinlongvh0904.hashnode.dev·16h ago · 22 min readInvestigation Diary: HTB — BrutusIntroduction "Logs never lie. They just sit quietly, waiting for someone who knows the right question to ask." Brutus is a Very Easy Sherlock on HackTheBox, built around two artifacts every Linux in00
YPYogesh Peelainexploitnotes.hashnode.dev·3d ago · 13 min readHackTheBox: Delegate WriteupSummary Delegate is an Active Directory box built around a chain of AD misconfigurations rather than a single bug. Anonymous/guest SMB access leaks a logon script (users.bat) on the NETLOGON share con00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 4 · 10 min readHackTheBox: Watcher WriteupSummary Watcher is a Linux box built around a self-hosted Zabbix monitoring stack. The front door isn't a permissions misconfig at all - it's a real Zabbix CVE (CVE-2024-22120), a time-based blind SQL00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 4 · 18 min readHackTheBox: Phoenix WriteupSummary Phoenix is a WordPress box with a long, winding path to root. The short version: an unauthenticated SQL injection in a forum plugin leaks the whole WordPress database, which gives admin creden00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 2 · 7 min readHackTheBox: vulnEscape WriteupSummary Escape is a Windows box that exposes only RDP (3389). The RDP session drops you into a locked-down kiosk account (KioskUser0) meant for a "Conference Display" app. The box is solved entirely t00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 2 · 21 min readHackTheBox: LustrousTwo WriteupSummary This box is a Windows Active Directory domain controller that only accepts Kerberos authentication (NTLM is disabled). Initial access starts with anonymous FTP exposing a valid username list, 00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 1 · 9 min readHackTheBox: Reset WriteupSummary Reset is a Linux box built around a chain of web application logic flaws and a legacy authentication misconfiguration. Initial access starts with a password reset endpoint that leaks the new a00
YPYogesh Peelainexploitnotes.hashnode.dev·Jul 1 · 9 min readHackTheBox: VulnCicada WriteupSummary Started with a full nmap sweep that showed a standard Domain Controller (DNS, Kerberos, LDAP, SMB, RPC) but with two extra things worth noting: an NFS server running alongside it, and AD CS (C00
YPYogesh Peelainexploitnotes.hashnode.dev·Jun 29 · 10 min readHackTheBox: Sendai WriteupSummary Sendai is a Windows Active Directory machine exposed with SMB guest access. RID brute-forcing reveals a full user list, and two accounts have expired passwords that can be reset with no knowle00
