HackTheBox

Machine Writeups

Step-by-step walkthroughs of HackTheBox machines. Real attack chains, real techniques — obfuscated IPs, redacted flags.

HTB Jul 5, 2026 3 min read

MakeSense

Walkthrough of the HackTheBox machine MakeSense: weaponising an exposed AES-GCM key to inject XSS through an encrypted voice-transcription pipeline, hijacking a Selenium admin bot to create a WordPress administrator, then escalating to root through a PHP OCR service running as root.

HackTheBoxXSSAES-GCM

HTB Jun 28, 2026 2 min read

Nimbus

Walkthrough of the HackTheBox machine Nimbus: bypassing an SSRF blocklist with decimal IP encoding to steal AWS IAM credentials from the instance metadata service, injecting a malicious job into an SQS queue whose worker executes it as Python code, then escaping a privileged Docker container via LocalStack CodeBuild and the kernel modprobe path.

HackTheBoxSSRFIMDS

HTB Jun 28, 2026 2 min read

DevHub

Walkthrough of the HackTheBox machine DevHub: exploiting an unauthenticated STDIO transport in MCPJam Inspector for RCE, pivoting to a second user via a Jupyter token leaked in process arguments, then dumping root's SSH private key through a hidden API endpoint in an internally-running privileged service.

HackTheBoxMCPMCPJam

HTB Jun 28, 2026 3 min read

CheckPoint

Walkthrough of the HackTheBox machine CheckPoint: chaining AD Recycle Bin reanimation, two patched-BadSuccessor dMSA attacks, a malicious VS Code extension uploaded to an SMB share, and VM memory forensics to escalate from given user credentials to domain Administrator on a Windows Server 2025 domain controller.

HackTheBoxActive DirectoryBadSuccessor

HTB Jun 28, 2026 3 min read

Enigma

Walkthrough of the HackTheBox machine Enigma: chaining NFS enumeration, IMAP credential harvesting, an OpenSTAManager module upload RCE, bcrypt hash cracking, and a firewall-aware OliveTin password-argument injection to escalate from www-data to root.

HackTheBoxOpenSTAManagerNFS

HTB Jun 28, 2026 2 min read

Orion

Walkthrough of the HackTheBox machine Orion: exploiting an unauthenticated RCE in CraftCMS 5.6.16 (CVE-2025-32432) via CSRF bypass and Yii object injection, cracking a bcrypt hash from the MySQL database for SSH access, then escalating to root by abusing a telnetd authentication bypass (CVE-2026-24061).

HackTheBoxCraftCMSCVE-2025-32432

HTB Jun 28, 2026 3 min read

Nexus

Walkthrough of the HackTheBox machine Nexus: harvesting credentials from an exposed Gitea repository commit history, exploiting Krayin CRM file upload RCE (CVE-2026-38526), then escalating to root by weaponising an unsanitised os.path.join() call in a Gitea template sync service to write an SSH key into /root/.ssh/authorized_keys via directory traversal.

HackTheBoxGiteaKrayin CRM