1337 or Elite, The Cybersecurity writeups for the true cyber e1ite! Offsec, Hack The Box, and more🕵️♂️ Whether you're diving into the latest exploits or sharpening your skills 🛠️.
* Target: <TARGET_IP> (mail.autopilot.htb, Grommunio Linux edge) · Attacker: <KALI_IP> (tun0) * Domain: autopilot.htb · Internal: MAIL MAIL, DC01 DC01, WS02 WS02 * OS: Linux (Grommunio)
Overview * Target IP: 10.129.xx.xx * Attacker (VPN) IP: 10.10.xx.xx * Supplied credentials: Jenny Crawford / KS7X2M The box is themed around a fictional airline check-in kiosk
Machine Name: Layover Operating System: Linux Difficulty: Medium Executive Summary Layover is a medium-rated Linux box themed around a corporate airport network. The path to compromise opens with an
Target: <TARGET_IP> My VPN tunnel IP: <VPN_TUN_IP> The placeholders I use throughout Placeholder What it actually is <TARGET_IP> The current
The box is called DanglingTree, and the name is the whole punchline — but I'm getting ahead of myself. Everything below is the long version: what I ran, what
Box: Cohort · OS: Linux (Ubuntu 24.04) · Difficulty: Easy Step 1 — Recon Goal: find the attack surface. sudo ip link set dev tun0 mtu 1300 # do this first, see note
Difficulty: Hard · OS: Windows two-forest Active Directory, reached through a Linux edge host Chain: Handlebars AST type-confusion RCE → credential reuse → Gitea CI pipeline poisoning → service-account takeover → ksu
Add the vhosts to your hosts file before starting: echo "<TARGET> bedside.htb research.bedside.htb" | sudo tee -a /etc/hosts # HTB VPN frequently black-holes
1. Enumeration 1.1 Port scan nmap -p- --min-rate 5000 -T4 <TARGET> -oN nmap_allports.txt nmap -sC -sV -p22,80,1515 <TARGET> -oN nmap_
Placeholders used Token Meaning $TARGET the target machine's IP $ATTACKER your VPN (tun0) IP $LPORT your reverse-shell listener port (e.g. 9001) [REDACTED] value intentionally removed 0.
OS: Linux · Difficulty: Hard · Theme: Cloud / AWS (LocalStack) misconfiguration Target <TARGET_IP> Attacker (tun0) <LHOST> /etc/hosts <TARGET_IP> nimbus.htb aws.nimbus.htb
* HTB: Checkpoint — Detailed Writeup (redacted, command-by-command) * Target: <target-ip> (DC01) · Attacker: <attacker-ip> (tun0) 0. Environment setup — two gotchas that will waste hours if
Difficulty: Easy OS: Linux (CentOS 7) Reconnaissance Port Scan nmap -sV -sC -p- --min-rate 5000 <TARGET_IP> PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 7.
HTB Machine: DevHub IP: <TARGET_IP> Attacker IP: <ATTACKER_IP> OS: Ubuntu 22.04.5 LTS Difficulty: Medium Category: Web / MCP Ecosystem / Lateral Movement Reconnaissance Port
Box: Reactor OS: Linux Difficulty: Easy Target IP: <TARGET_IP> Attacker IP: <ATTACKER_IP> (tun0) 1. Reconnaissance 1.1 Port Scan A full TCP port sweep
