Bugs found and work done, start to finish. Lab machines and my own code both land here.
HTB Active: Two Credential Failures and No Exploit at All2026-08-05A GPP password in a readable SYSVOL copy, then a domain administrator with a service principal name. Nothing here is a CVE - everything here is a misconfiguration somebody made on purpose.Hack The BoxWindowsEasyHTB Valentine: Heartbleed in a Loop, Then Somebody Else's tmux2026-05-17Heartbleed used properly - not "the scanner says vulnerable" but dumping memory repeatedly until a passphrase falls out. Root is not an exploit at all: a root process left its tmux socket group-readable.Hack The BoxLinuxEasyHTB Shocker: The Trailing Slash Is the Box2026-03-22The exploit is trivial once you find the script. Finding the script is the box, and the reason it is hard is a real Apache configuration detail that breaks default directory brute forcing.Hack The BoxLinuxEasyHTB Granny: An Extension Blocklist That Does Not Cover Rename2026-02-11The upload filter blocks PUT of an .aspx and allows MOVE of anything. That is the whole foothold, and it generalises: a blocklist that does not cover rename is not a control.Hack The BoxWindowsEasyHTB Jerry: A Tomcat Manager and One Guessed Password2025-12-28Possibly the easiest box on HTB, and it teaches one thing worth keeping: a Tomcat Manager with default credentials is remote code execution as whatever runs Tomcat, which on Windows is usually SYSTEM.Hack The BoxWindowsEasyHTB Blue: EternalBlue, With and Without Metasploit2025-11-29One CVE, no privilege escalation, done in five minutes. The value is not the solve - it is that MS17-010 is the most consequential SMB bug of the last decade and this is the safest place to watch it work.Hack The BoxWindowsEasyHTB Lame: Four Vulnerable Services, Two of Them Traps2025-10-07The first HTB machine, and a lesson in ruling things out. It shows four vulnerable-looking services: two are dead ends, one is a clean root, and one is a foothold with three separate escalations.Hack The BoxLinuxEasy