Lab Portfolio
A collection of my Hack The Box writeups with brief summaries and links to full reports.
Lab: Bedside
Completed the linux machine by exploiting vulnerable PDF processing for initial access, pivoting through an internal Docker container service, and abusing insecure model checkpoint deserialization to gain root access.
Lab: Make Sense
Completed the linux machine by utilizing: WordPress enumeration, stored XSS, browser automation abuse, Chrome DevTools Protocol exploitation, and OCR-to-PHP root code execution in a full end-to-end Linux compromise.
Lab: Paperwork
Compromised the “Paperwork” machine by exploiting a vulnerable legacy print service, pivoting through an internal printer-management interface, and chaining multiple misconfigurations to achieve full system access.
Lab: Paper
Paper is an Easy Linux Hack The Box machine that begins with virtual host discovery and a WordPress draft disclosure leading to an internal Rocket.Chat instance. A vulnerable Recyclops bot exposes credentials through path traversal, providing SSH access as dwight, before CVE-2021-3560 is used to escalate privileges to root.
Lab Summaries
Vaccine Lab Summary
Completed the Hack The Box Vaccine machine in an authorized lab environment and documented the full attack chain from initial reconnaissance through root access.
The assessment began with service enumeration that identified anonymous FTP access and an exposed password-protected application backup. I extracted the archive hash with zip2john, recovered the password using John the Ripper, and reviewed the exposed PHP source code. The source revealed hardcoded authentication data and an MD5 password hash, which I cracked with Hashcat to access the administrative dashboard.
After authenticating, I identified a vulnerable search parameter and used Burp Suite and SQLMap to confirm PostgreSQL SQL injection. The database privileges allowed operating-system command execution, resulting in a reverse shell as the postgres user.
Post-exploitation enumeration revealed hardcoded database credentials that were reused for SSH access. I then identified an unsafe sudo permission allowing vi to run as root and used its shell functionality to obtain root access.
Skills Demonstrated
Network and service enumeration
Anonymous FTP assessment
Password-hash extraction and cracking
PHP source-code review
Web authentication analysis
Burp Suite request inspection
PostgreSQL SQL injection testing
Linux reverse-shell access
Credential-reuse analysis
SSH access and post-exploitation enumeration
Linux sudo privilege escalation
Vulnerability remediation and technical documentation
Tools Used
Nmap, FTP, zip2john, John the Ripper, Hashcat, Burp Suite, SQLMap, Netcat, SSH, and Linux command-line utilities.
MetaTwo Lab Summary
Completed the Hack The Box MetaTwo machine in an authorized lab environment and documented the full attack chain from initial reconnaissance through root access.
The assessment began with network and service enumeration, which identified FTP, SSH, and HTTP services. Web enumeration revealed a WordPress installation running the BookingPress Appointment Booking plugin. Further inspection identified BookingPress version 1.0.10, which was vulnerable to CVE-2022-0739, an unauthenticated SQL injection vulnerability. I manually reproduced the vulnerable AJAX request and used UNION-based SQL injection to extract WordPress usernames and password hashes from the database.
After cracking the manager account password with John the Ripper, I authenticated to the WordPress administrative interface and identified media upload functionality. I then exploited an authenticated XXE vulnerability through crafted WAV metadata, allowing arbitrary file reads from the server. This was used to retrieve wp-config.php, which exposed valid FTP credentials.
Authenticated FTP enumeration revealed a separate mailer application containing hardcoded SMTP credentials for the local jnelson user. The password was reused for SSH, providing an interactive shell and access to the user flag.
During privilege-escalation enumeration, I discovered a Passpie password vault containing an encrypted PGP private key and a stored root credential. I extracted the private key, converted it with gpg2john, and cracked its passphrase with John the Ripper. Using the recovered Passpie master password, I exported the vault, recovered the root password, and switched to the root account to complete the machine.
Skills Demonstrated
Network and service enumeration
WordPress fingerprinting and plugin enumeration
Vulnerability research and CVE identification
Manual AJAX request analysis
UNION-based SQL injection exploitation
WordPress password-hash extraction and cracking
Authenticated WordPress enumeration
XXE exploitation through malicious media metadata
Arbitrary file-read exploitation
FTP enumeration and credential discovery
Credential-reuse analysis
SSH access and Linux post-exploitation
Passpie password-vault analysis
PGP private-key extraction and cracking
Linux privilege escalation
Technical documentation and attack-path analysis
Tools Used
Nmap, WhatWeb, WPScan, cURL, John the Ripper, FTP, SSH, Python, gpg2john, Passpie, and Linux command-line utilities.
Paper Lab Summary
Completed the Hack The Box Paper machine in an authorized lab environment and documented the full attack chain from initial reconnaissance through root access.
The assessment began with network and service enumeration, which identified SSH, HTTP, and HTTPS services. HTTP header inspection revealed the hidden office.paper virtual host, which hosted a WordPress 5.2.3 installation.
Further WordPress enumeration identified a draft-disclosure issue accessible through the static parameter. This exposed unpublished content containing a private registration URL for an internal Rocket.Chat instance hosted at chat.office.paper. After registering an account, I discovered the Recyclops bot, which was designed to retrieve files from Dwight's Sales directory.
Testing the bot's file-handling functionality revealed a directory-traversal vulnerability that allowed access outside the intended /sales/ directory. I used the traversal to enumerate Dwight's home directory and retrieve the Hubot .env configuration file, which contained credentials for the Recyclops account. The exposed password was reused by the local dwight account, providing SSH access to the server and access to the user flag.
During privilege-escalation enumeration, I identified CentOS 8 running a vulnerable Polkit configuration with accounts-daemon enabled. The system was vulnerable to CVE-2021-3560, a Polkit authentication-bypass vulnerability. After transferring and executing a proof-of-concept exploit, a privileged local account was created, allowing escalation to the root account and completion of the machine.
Skills Demonstrated
Network and service enumeration
HTTP header analysis
Virtual-host discovery
WordPress fingerprinting and enumeration
WordPress draft-disclosure exploitation
Internal application discovery
Rocket.Chat enumeration
Custom bot functionality analysis
Directory-traversal exploitation
Arbitrary file-read exploitation
Environment-file and credential discovery
Credential-reuse analysis
SSH access and Linux post-exploitation
Linux service and package enumeration
Polkit vulnerability identification
CVE-2021-3560 exploitation
Linux privilege escalation
Technical documentation and attack-path analysis
Tools Used
Nmap, cURL, Rocket.Chat, SSH, SCP, Python, dbus-send, and Linux command-line utilities.