--- title: "#htb articles | Hashnode" description: "Explore 110 articles tagged #htb on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/htb" --- Tag # #htb 110 posts · 12 followers [Nano](https://hashnode.com/@0xNano) · [Oct 26](https://hashnode.com/posts/forest-writeup/6adeddb917055badcbe8491d) ### [Forest WriteUp](https://blog.0xnano.com/forest-writeup?utm_source=hashnode&utm_medium=feed) HTB Forest writeup: ASREPRoasting, BloodHound enumeration, and Exchange Windows Permissions abuse to achieve DCSync and Domain Admin. 4 min read · [blog.0xnano.com](https://blog.0xnano.com/forest-writeup?utm_source=hashnode&utm_medium=feed) [arosion](https://hashnode.com/@arosion) · [Sep 23](https://hashnode.com/posts/babytwo/6ab34259b1ba63c0c8d05f6b) ### [BabyTwo](https://arosion-labs.hashnode.dev/babytwo?utm_source=hashnode&utm_medium=feed) Hackthebox Machine 11 min read · [arosion-labs.hashnode.dev](https://arosion-labs.hashnode.dev/babytwo?utm_source=hashnode&utm_medium=feed) [Vivek Goswami](https://hashnode.com/@vivekgoswami) · [Sep 5](https://hashnode.com/posts/zico2-vulnhub-2026-writeup/6a9c548b3be9c04494b33298) ### [Zico2 - Vulnhub 2026 Writeup](https://vivekgoswami.hashnode.dev/zico2-vulnhub-2026-writeup?utm_source=hashnode&utm_medium=feed) Zico2 VulnHub 2026 Boot to Root walkthrough covering Nmap, web enumeration, exploitation, Linux privilege escalation & root access. #VulnHub #OSCP2026 2 min read · [vivekgoswami.hashnode.dev](https://vivekgoswami.hashnode.dev/zico2-vulnhub-2026-writeup?utm_source=hashnode&utm_medium=feed) [Vivek Goswami](https://hashnode.com/@vivekgoswami) · [Sep 3](https://hashnode.com/posts/midnight-sunset-walkthrough-2026-proving-grounds-vulnhub/6a99df314d14c7584956dfc2) ### [Midnight Sunset Walkthrough 2026 - Proving Grounds/Vulnhub](https://vivekgoswami.hashnode.dev/midnight-sunset-walkthrough-2026-proving-grounds-vulnhub?utm_source=hashnode&utm_medium=feed) Start by downloading the Vulnerable machine from - https://www.vulnhub.com/entry/sunset-midnight,517/ Add it to virtual box and adjust the network setting as per your convenience , i set it to host on 5 min read · [vivekgoswami.hashnode.dev](https://vivekgoswami.hashnode.dev/midnight-sunset-walkthrough-2026-proving-grounds-vulnhub?utm_source=hashnode&utm_medium=feed) [MOHIT SINGH PAPOLA](https://hashnode.com/@reapsec) · [Aug 6](https://hashnode.com/posts/sendai-htb/6a74d1673f5b8f54f32c6416) ### [Sendai](https://blog.reapsec.com/sendai-htb?utm_source=hashnode&utm_medium=feed) (Medium Windows) 6 min read · [blog.reapsec.com](https://blog.reapsec.com/sendai-htb?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 14](https://hashnode.com/posts/hackthebox-jinjacare/6a56248e1def916a1edb1f86) ### [HackTheBox : JinjaCare](https://exploitnotes.hashnode.dev/hackthebox-jinjacare?utm_source=hashnode&utm_medium=feed) Complete Hack The Box JinjaCare writeup covering wkhtmltopdf HTML injection, local file inclusion, Flask SSTI, Jinja2 sandbox escape, and root RCE. 9 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-jinjacare?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 13](https://hashnode.com/posts/hackthebox-neovault-challenge-writeup/6a549a31cb8d87bccd25c05a) ### [HackTheBox: NeoVault Challenge Writeup](https://exploitnotes.hashnode.dev/hackthebox-neovault-challenge-writeup?utm_source=hashnode&utm_medium=feed) Solve Neo Vault by exploiting NoSQL injection to leak ObjectIds, then abusing a legacy v1 IDOR to download the flag-containing bank statement PDF. 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-neovault-challenge-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 2](https://hashnode.com/posts/hackthebox-vulnescape-writeup/6a46216f909de8bc9f8ae581) ### [HackTheBox: vulnEscape Writeup](https://exploitnotes.hashnode.dev/hackthebox-vulnescape-writeup?utm_source=hashnode&utm_medium=feed) Complete vulnEscape HTB walkthrough covering Edge kiosk escape, application allowlist bypass, credential recovery, and admin access. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-vulnescape-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jul 1](https://hashnode.com/posts/hackthebox-reset-writeup/6a44b43ce8b23f2bff033bf9) ### [HackTheBox: Reset Writeup](https://exploitnotes.hashnode.dev/hackthebox-reset-writeup?utm_source=hashnode&utm_medium=feed) Complete HTB Reset walkthrough covering password reset flaw, LFI, Apache log poisoning, RCE, rlogin abuse, and root privilege escalation. 9 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-reset-writeup?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Jun 29](https://hashnode.com/posts/hackthebox-sendai-writeup/6a420f7c37a344b3fff494b4) ### [HackTheBox: Sendai Writeup](https://exploitnotes.hashnode.dev/hackthebox-sendai-writeup?utm_source=hashnode&utm_medium=feed) A complete Sendai HTB walkthrough covering SMB enumeration, AD privilege escalation, GMSA abuse, MSSQL exploitation, and SYSTEM compromise. 10 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/hackthebox-sendai-writeup?utm_source=hashnode&utm_medium=feed)