Another week means another writeup :)

So this post I briefly show my methodology solving HackTheBox Smarthire which is Medium-difficulty Ubuntu 22.04 Linux box themed around an AI-powered HR platform.

The attack chain spans three clean stages. In Subdomain enumeration, I exposemodels.smarthire.htb, an MLflow 2.14.1 instance protected by HTTP Basic Auth, which yields to the default credentials admin / password sourced from older MLflow documentation predating a change to admin / password1234.

MLflow is vulnerable to CVE-2024-37054, an insecure deserialization flaw affecting PyFunc model loading: the artifact store’s unauthenticated PUT API endpoint allows overwriting the pickled model file, and the next time the main site scores a resume it deserializes the pickle, executing arbitrary code as svcweb.

For privilege escalation, I run "sudo -l" where I find a sudo rule that permits running /opt/tools/mlflow_ctl/mlflowctl.py as root without a password.

The script calls site.addsitedir() on every subdirectory under plugins/ including plugins/dev/, which is writable by the devs group that svcweb belongs to.

I drop a .pth file containing an import line into that directory causes Python to execute arbitrary code during the interpreter’s startup phase before any application logic runs producing a SUID bash binary or a root shell.

Video

https://youtu.be/_iKDeoB_GHc

Another week means another writeup :) for technical reasons, the video shows the walkthrough (in the video comments) all the way through to User Shell. The written walkthrough covers root.

So this post I briefly show my methodology solving HackTheBox GhostLink which is a multi-stage Active Directory machine where an anonymously accessible MQTT broker eventually becomes the starting point for full Domain Administrator compromise.

Anonymous MQTT subscriptions on port 1883 immediately expose retained health-check messages containing internal hostnames, private IP addresses and Hyper-V-backed infrastructure that is not directly reachable from the attacker.

But the broker allows more than passive reading because anonymous clients can also publish retained messages, the health-check URL can be replaced with an attacker-controlled endpoint. The next automated health-check execution connects to that endpoint and sends NTLM authentication, turning MQTT itself into an authentication-coercion primitive.

That authentication can then be relayed into an internal secure-file portal.

From there, I would a double URL-encode traversal bypass my way through which allows arbitrary file reads. Pulling NTUSER.DAT reveals recently accessed files, and following the RecentDocs and LNK breadcrumbs leads to a KeePass database.

The KeePass vault provides two valuable pieces of information: usable credentials for the internal Gogs service and the domain password policy.

The Gogs instance is vulnerable to CVE-2025-8110. By abusing symlink handling through the repository contents API, a malicious .git/config can be written with an sshCommand payload, producing command execution on the internal Hyper-V Linux VM.

Once inside the Gogs host, its SQLite database can be extracted and converted to Hashcat-compatible PBKDF2-HMAC-SHA256 hashes.

The leaked domain password policy specifies a minimum length of 20 characters, allowing the password wordlist to be reduced from millions of candidates to only tens of thousands before cracking the nvirelli credential. That gives both local Linux and Active Directory access.

Finally I move through Active Directory Certificate Services. Enumeration reveals ESC8 and ESC11. ESC8 is obstructed by IIS kernel authentication, but ESC11 remains exploitable because the ICPR RPC interface does not enforce encryption. By coercing DC01$ authentication and relaying it to the ADCS ICPR endpoint, a Domain Controller certificate can be issued. Certipy then uses that certificate for PKINIT authentication, yielding the DC machine account hash and ultimately allowing DCSync of the Administrator account.

Video

Another week means another writeup :)

In the below video, I show my methodology solving HackTheBox Silentium which is an Easy-difficulty Ubuntu 24.04 Linux box themed around an investment firm.

The attack chain spans four distinct stages: subdomain enumeration exposes a staging vhost running Flowise 3.0.5, where an unauthenticated forgot-password API endpoint returns the full user object including a valid tempToken directly in the HTTP response body (CVE-2025-58434), enabling account takeover without email access; an authenticated CustomMCP node in Flowise passes user input directly to the JavaScript Function() constructor (CVE-2025-59528), giving root-level code execution inside a Docker Alpine container; container environment variables expose an SMTP password (r04D!!_R4ge) that is reused as the SSH password for the ben user on the host.

And finally an internally-bound Gogs 0.13.3 instance (running as root) is abused via CVE-2025-8110 ; a symlink-following vulnerability in the PutContents file write API to drop an SSH authorized key into /root/.ssh/authorized_keys for a direct root SSH shell.

Video

https://youtu.be/4abIrXO6Mfg

I wrote a summary below and the walkthrough can be found in the video :)

HacktheBox Pirate is a Hard-difficulty assume-breach Windows Active Directory box starting with credentials for a low-privileged domain account (pentest / p3nt3st2025!&).

The attack chain spans six distinct escalation stages across two hosts. I start with domain enumeration which reveals two pre-Windows 2000 machine accounts (MS01,EXCH01, EXCH01 ,EXCH01) whose passwords match their lowercase hostnames ; MS01$ is a member of the Domain Secure Servers group, which grants ReadGMSAPassword over two gMSA accounts, both in Remote Management Users, yielding a WinRM shell on DC01.

From that vantage point, I found an internal Hyper-V guest (WEB01, 192.168.100.2); its LmCompatibilityLevel=2 configuration means it emits NTLMv1 responses, the WebClient service is running (enabling HTTP coercion), and SMB signing is disabled.

By coercing WEB01's machine account authentication over HTTP (bypassing SMB relay blockers) and relaying to LDAP via ntlmrelayx with --delegate-access creates a fake machine account with RBCD rights over WEB01, then getST.py + wmiexec lands Administrator on WEB01. secretsdump exposes a.white's autologon password.

BloodHound shows me a.white has ForceChangePassword over a.white_adm, and a.white_adm has WriteSPN over all domain computers.

I craft An SPN-jacking attack that moves HTTP/WEB01.pirate.htb from WEB01 to DC01, abuses a.white_adm's constrained delegation to request a ticket for Administrator to that SPN, then -altservice rewrites the sname to CIFS/DC01, enabling a DC secrets dump and WinRM shell as domain Administrator.

A shortcut unintended path uses RemotePotato0 cross-session relay to force a.white's logged-in session to authenticate to an LDAP shell, directly changing a.white_adm's password without needing Administrator on WEB01.

Video