HackTheBox writeups across Active Directory, Linux, and web.https://certifa.net/https://certifa.net/writeups/htb-shocker/https://certifa.net/writeups/htb-shocker/A CGI shell script backed by a vulnerable Bash lets a crafted HTTP header trigger Shellshock (CVE-2014-6271) for RCE. Privesc via a passwordless sudo rule on perl, one GTFOBins command to root.Wed, 01 Jul 2026 00:00:00 GMTlinuxwebcgishellshockcve-2014-6271sudogtfobinspriveschttps://certifa.net/writeups/htb-kobold/https://certifa.net/writeups/htb-kobold/A wildcard TLS certificate leaks a subdomain running MCPJam Inspector v1.4.2, whose /api/mcp/connect endpoint executes attacker-supplied commands with no authentication. Privesc via docker group membership: reactivated with newgrp, then a container mount of the host filesystem to root.Sun, 15 Mar 2026 00:00:00 GMTlinuxwebsubdomain-enumerationMCPCVE-2026-23744dockerpriveschttps://certifa.net/writeups/htb-cctv/https://certifa.net/writeups/htb-cctv/Default credentials on an exposed ZoneMinder console lead to a blind SQL injection (CVE-2024-51482) that dumps a crackable hash for SSH. Root comes from a loopback-bound motionEye reached over an SSH tunnel, where a filename field is passed unsanitised to a Motion daemon running as root (CVE-2025-60787).Sat, 07 Mar 2026 00:00:00 GMTlinuxwebzonemindersqliCVE-2024-51482motioneyeCVE-2025-60787ssh-tunnelingcommand-injectionhttps://certifa.net/writeups/htb-pirate/https://certifa.net/writeups/htb-pirate/Active HackTheBox machine. Full writeup published after retirement.Sun, 01 Mar 2026 00:00:00 GMTwindowsactive-directorypre2kgmsakerberosntlm-relayrbcdconstrained-delegationspn-jackingligolo-ngpriveschttps://certifa.net/writeups/htb-gavel/https://certifa.net/writeups/htb-gavel/Linux web box: exposed .git repo leaks PHP source revealing a SQLi, admin panel RCE via PHP rule engine, then privesc by abusing a root-run auction daemon that executes YAML-defined PHP rules.Sun, 12 Oct 2025 00:00:00 GMTlinuxwebsqligit-dumperphprceyamlsuidpriveschttps://certifa.net/writeups/htb-darkzero/https://certifa.net/writeups/htb-darkzero/Active Directory box featuring MSSQL lateral movement across two domains, kernel exploitation (CVE-2024-30088) via Metasploit, and Golden Ticket via Rubeus + PetitPotam to compromise the forest.Sun, 05 Oct 2025 00:00:00 GMTwindowsactive-directorymssqlkerberosCVE-2024-30088golden-ticketrubeuspriveschttps://certifa.net/writeups/htb-return/https://certifa.net/writeups/htb-return/LDAP credential capture from a printer web panel, followed by Server Operators privilege escalation via service binary path modification.Sat, 04 Oct 2025 00:00:00 GMTwindowsactive-directoryldapprivescserver-operatorshttps://certifa.net/writeups/htb-cicada/https://certifa.net/writeups/htb-cicada/Beginner-friendly Windows AD box: anonymous SMB enumeration leads to default credentials, password spraying finds a foothold, and SeBackupPrivilege escalates to Administrator via SAM dump.Fri, 03 Oct 2025 00:00:00 GMTwindowsactive-directorysmbpassword-spraySeBackupPrivilegepass-the-hashhttps://certifa.net/writeups/htb-expressway/https://certifa.net/writeups/htb-expressway/Linux box with IKE/ISAKMP on UDP/500: crack the PSK with psk-crack, SSH in, then exploit a vulnerable sudo version (CVE-2025-32463) to root.Mon, 22 Sep 2025 00:00:00 GMTlinuxikevpnpsk-cracksshCVE-2025-32463sudoprivesc