AarosionSep 23 · 11 min readBabyTwoBabyTwo is a medium-difficulty Windows machine set in an Active Directory environment. The initial foothold is gained through password guessing and the abuse of Windows logon scripts. Privilege escalaarosion-labs.hashnode.dev
VVivek GoswamiSep 5 · 2 min readZico2 - Vulnhub 2026 WriteupBox: Zico2: 1 Author: Rafael Difficulty: Beginner–Intermediate Download: https://www.vulnhub.com/entry/zico2-1,210/ Goal: Get a foothold on the web server, pivot to a local user, then escalate to root1vivekgoswami.hashnode.dev
VVivek GoswamiSep 3 · 5 min readMidnight Sunset Walkthrough 2026 - Proving Grounds/VulnhubStart by downloading the Vulnerable machine from - https://www.vulnhub.com/entry/sunset-midnight,517/ Add it to virtual box and adjust the network setting as per your convenience , i set it to host on1vivekgoswami.hashnode.dev
MMOHIT SINGH PAPOLAAug 6 · 6 min readSendaiOVERVIEW So we have been told the user flag will be in C:/ directory and also gave us the target IP address Let's start the enumeration using NMAP ENUMERATION Let's start with Anonymous Login withblog.reapsec.com
YYogeshwar PeelaJul 14 · 9 min readHackTheBox : JinjaCareSummary JinjaCare is a Flask-based COVID-19 vaccination verification web app. The intended path chains wkhtmltopdf HTML/local-file injection (via the certificate-generation feature) to disclose the Flexploitnotes.hashnode.dev
YYogeshwar PeelaJul 13 · 8 min readHackTheBox: NeoVault Challenge WriteupSummary NeoVault is a small banking app (Next.js frontend + REST API) that lets users register, transfer funds, and download PDF statements. The API ships in two parallel versions, v1 and v2. v2 patchexploitnotes.hashnode.dev
YYogeshwar PeelaJul 2 · 7 min readHackTheBox: vulnEscape WriteupSummary Escape is a Windows box that exposes only RDP (3389). The RDP session drops you into a locked-down kiosk account (KioskUser0) meant for a "Conference Display" app. The box is solved entirely texploitnotes.hashnode.dev
YYogeshwar PeelaJul 1 · 9 min readHackTheBox: Reset WriteupSummary Reset is a Linux box built around a chain of web application logic flaws and a legacy authentication misconfiguration. Initial access starts with a password reset endpoint that leaks the new aexploitnotes.hashnode.dev
YYogeshwar PeelaJun 29 · 10 min readHackTheBox: Sendai WriteupSummary Sendai is a Windows Active Directory machine exposed with SMB guest access. RID brute-forcing reveals a full user list, and two accounts have expired passwords that can be reset with no knowleexploitnotes.hashnode.dev
YYogeshwar PeelaJun 28 · 7 min readHackTheBox: Sloink WriteupSummary NFS shares exposed the target's home directory and PostgreSQL backups. The user's psql history contained an MD5 hash that cracked to service. SSH with that account drops you immediately (shellexploitnotes.hashnode.dev
