Writeup Matrix

HTB: Takeoff

OS

linux

DIFFICULTY

hard

RELEASED

2026-10-31

HTB: DutyBond

OS

linux

DIFFICULTY

medium

RELEASED

2026-10-24

HTB: Autopilot

OS

windows

DIFFICULTY

insane

RELEASED

2026-10-17

HTB: Stream

OS

linux

DIFFICULTY

medium

RELEASED

2026-10-10

HTB: Touch

OS

windows

DIFFICULTY

easy

RELEASED

2026-10-03

HTB: Layover

OS

linux

DIFFICULTY

medium

RELEASED

2026-09-26

HTB: TrustFall

OS

windows

DIFFICULTY

insane

RELEASED

2026-09-11

HTB: Scaffold

OS

windows

DIFFICULTY

hard

RELEASED

2026-09-05

HTB: BlockSynergy

OS

linux

DIFFICULTY

insane

RELEASED

2026-08-29

HTB: DarkZeroReturns

OS

windows

DIFFICULTY

hard

RELEASED

2026-07-25

HTB: Fireflow

Fireflow is a medium Linux machine featuring a Langflow AI agent platform vulnerable to CVE-2026-33017, unauthenticated RCE via exec() injection to gain a foothold, Langflow superuser credentials leaked from the process environment for lateral movement, a JWT alg:none bypass against an MCP Tool Registry for code execution inside a Kubernetes pod, and kubelet WebSocket exec via nodes/proxy RBAC against a privileged node-exporter pod with the host filesystem mounted for root.

OS

linux

DIFFICULTY

medium

RELEASED

2026-06-23

HTB: Nexus

Nexus is an easy Linux machine featuring a Gitea instance that leaks a legacy password in its commit history, a Krayin CRM login vulnerable to authenticated RCE via TinyMCE uploads (CVE-2026-38526) for a foothold as www-data, reused .env credentials to pivot to jones, and a root-run Gitea template-sync script whose unsanitized os.path.join enables a Git path-traversal write to root's authorized_keys.

OS

linux

DIFFICULTY

easy

RELEASED

2026-06-23

HTB: Checkpoint

Checkpoint is a medium Windows machine starting with assumed-breach credentials which carry write access over the AD Recycle Bin, letting me restore a deleted user which can write to the DevDrop SMB share. A malicious .VSIX extension (CVE-2025-55319) file executes when the developer opens VS Code, granting the user shell. From there I abuse BetterSuccessor (CVE-2025-53779), creating a delegated Managed Service Account that supersedes svc_deploy and inherits BackupAccess rights. That unlocks the VMBackups share, where a VMware memory snapshot gives up the Administrator hash through VMkatz, leading to full domain compromise via Pass-the-Hash.

OS

windows

DIFFICULTY

medium

RELEASED

2026-06-13

HTB: Connected

OS

linux

DIFFICULTY

easy

RELEASED

2026-06-06

HTB: Expressway

Expressway is an easy Linux machine featuring an IKE/IPsec VPN endpoint that leaks an aggressive-mode pre-shared key, offline IKE-PSK SHA1 cracking for SSH access as the ike user, and a vulnerable sudo version (CVE-2025-32463) leading straight to root.

OS

linux

DIFFICULTY

easy

RELEASED

2025-09-20

HTB: Alert

Alert is an easy Linux machine featuring a markdown viewer with stored cross-site scripting, an admin-only page vulnerable to arbitrary file read used to steal an .htpasswd hash, cracked credentials for SSH, and a group-writable PHP config served by root for privilege escalation.

OS

linux

DIFFICULTY

easy

RELEASED

2024-11-23

HTB: Editorial

Editorial is an easy Linux machine featuring a book-publishing web app vulnerable to server-side request forgery, an internal Flask API leaking dev credentials, plaintext credentials in git history for lateral movement, and a GitPython RCE (CVE-2022-24439) via a root sudo script for privilege escalation.

OS

linux

DIFFICULTY

easy

RELEASED

2024-06-15

HTB: BoardLight

BoardLight is an easy Linux machine featuring a Dolibarr CRM/ERP instance vulnerable to CVE-2023-30253, PHP code injection to gain a foothold, reused database credentials to pivot laterally, and an Enlightenment SUID abuse (CVE-2022-37706) for privesc.

OS

linux

DIFFICULTY

easy

RELEASED

2024-05-25