Enigma is a Linux Hack The Box machine that combines exposed network services, information disclosure, credential recovery, and command injection. Initial enumeration reveals an NFS share containing onboarding information and a Roundcube webmail instance. Further enumeration exposes application credentials and database data that can be leveraged for lateral movement. Privilege escalation is achieved by abusing an OliveTin backup action vulnerable to command injection, allowing arbitrary commands to execute with elevated privileges and ultimately providing root access.

CodeTwo is a easy difficulty Linux machine on HTB that demonstrates the risks of insecure dependencies and misconfigured backup tools. By exploiting a vulnerable js2py sandbox (CVE-2024-28397), attackers can gain RCE through the web dashboard. From there, weakly hashed SQLite credentials enable lateral movement into the Marco account. Finally, abuse of npbackup-cli with sudo privileges allows escalation to root. This machine teaches players about dependency exploits, credential cracking, and privilege escalation through misconfigured backup utilities.

Cypher is a medium level Linux machine on HTB that teaches you how subtle misconfigurations in Neo4j and custom APOC functions can lead to devastating command injections. You’ll start by uncovering a suspicious JAR file in the webserver’s /testing directory, revealing a poorly handled curl call. From there, a clever Cypher injection in the login mechanism enables remote command execution. After pivoting from the neo4j account to graphasm by discovering re-used credentials, the final challenge is to exploit a tool with sudo privileges to read sensitive root-owned files. Players will gain valuable experience with Cypher injection, Neo4j internals, and creative ways to elevate privileges on a Linux system.

A comprehensive walkthrough of exploiting the EscapeTwo HTB machine, from SMB share enumeration and leveraging MS SQL xp_cmdshell to advanced AD Certificate Services exploitation.

A comprehensive walkthrough of exploiting the Titanic HTB machine, from initial Nmap scanning and directory traversal to cracking Gitea hashes and leveraging a vulnerable ImageMagick (CVE-2024-41817) for root access.

An in-depth look at dirsearch, a powerful open-source tool for uncovering hidden directories and files on web servers.