CodeTwo is a easy difficulty Linux machine on HTB that demonstrates the risks of insecure dependencies and misconfigured backup tools. By exploiting a vulnerable js2py sandbox (CVE-2024-28397), attackers can gain RCE through the web dashboard. From there, weakly hashed SQLite credentials enable lateral movement into the Marco account. Finally, abuse of npbackup-cli with sudo privileges allows escalation to root. This machine teaches players about dependency exploits, credential cracking, and privilege escalation through misconfigured backup utilities.

Cypher is a medium level Linux machine on HTB that teaches you how subtle misconfigurations in Neo4j and custom APOC functions can lead to devastating command injections. You’ll start by uncovering a suspicious JAR file in the webserver’s /testing directory, revealing a poorly handled curl call. From there, a clever Cypher injection in the login mechanism enables remote command execution. After pivoting from the neo4j account to graphasm by discovering re-used credentials, the final challenge is to exploit a tool with sudo privileges to read sensitive root-owned files. Players will gain valuable experience with Cypher injection, Neo4j internals, and creative ways to elevate privileges on a Linux system.

A comprehensive walkthrough of exploiting the EscapeTwo HTB machine, from SMB share enumeration and leveraging MS SQL xp_cmdshell to advanced AD Certificate Services exploitation.

A comprehensive walkthrough of exploiting the Titanic HTB machine, from initial Nmap scanning and directory traversal to cracking Gitea hashes and leveraging a vulnerable ImageMagick (CVE-2024-41817) for root access.

An in-depth look at dirsearch, a powerful open-source tool for uncovering hidden directories and files on web servers.