Frans Coomans

Cybersecurity Consultant
(Offensive Security)

HTB Machine Write-ups

Editor

12 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Reverse Shell, Credential Looting, Privilege Escalation, SSH Local Port Forwarding, Password Reuse,
Tools: rustscan, nmap, searchsploit, CVE-2025-24893, nc, CVE-2024-32019, msfvenom

This box starts with an outdated XWiki instance on Jetty, vulnerable to CVE-2025-24893, which provides a straightforward unauthenticated RCE via Groovy payload injection in a crafted RSS request. Once I gained code execution, I caught a reverse sh...

Era

21 minute read

OS: Linux
Difficulty: Medium
Skills: Enumeration, IDOR, Database Looting, Code Analysis, Password Cracking, Reverse Shell, PHP SSH2 Wrapper, Authentication Bypass, Arbitrary File Upload, ELF Signing, Privilege Escalation
Tools: rustscan, nmap, ffuf, sqlite3, hashcat, Revshells, nc, LinPEAS, pspy64, openssl, readelf, objcopy

The Era machine was an enjoyable mix of enumeration and web exploitation, topped off with a creative abuse of PHP wrappers. After spotting limited open ports (FTP and HTTP), the real action began with virtual host fuzzing, which revealed a file-sh...

Mirage

36 minute read

OS: Windows
Difficulty: Hard
Skills: Enumeration, ACE Abuse, Kerberos, Password Cracking, GMSA Password Read, Reverse Shell, ESC10, RBCD, Privilege Escalation
Tools: rustscan, nmap, nxc, BloodHound, hashcat, bloodyAD, impacket-getTGT, impacket-getST, impacket-secretsdump, impacket-GetUserSPNs, klist, evil-winrm, RunasCs, nc, certipy-ad, ntpdate, nsupdate

I immediately noticed that an NFS server was running on the Mirage Windows Server — unusual on its own — and further inspection revealed two files being shared. The first mentioned that the company was in the process of phasing out NTLM authentica...

Outbound

12 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Reverse Shell, Chisel Port Forwarding, Privilege Escalation
Tools: rustscan, nmap, nc, RevShells, CVE-2025-49113, chisel, mysql, CVE-2025-27591

I began Outbound by accessing the Roundcube Webmail interface using Tyler’s credentials. The server was running Roundcube Webmail 1.6.10, which is vulnerable to CVE-2025-49113, a Post-Authentication Remote Command Execution (RCE) flaw. Leveraging...

RustyKey

26 minute read

OS: Windows
Difficulty: Hard
Skills: Enumeration, Time Roasting, ACE Abuse, Kerberos, Password Cracking, DLL Hijacking, Reverse Shell, RBCD, Privilege Escalation
Tools: rustscan, nmap, nxc, BloodHound, timeroast.py, hashcat, bloodyAD, impacket-getTGT, klist, evil-winrm, msfvenom, PowerView, Rubeus, RunasCs, nc

During the assessment, I began by performing timeroasting against the rustykey.htb SNTP service. This technique yielded hashes for several computer accounts, including IT-Backup3$, whose hash was cracked within seconds. Using this, I requested a K...

Voleur

27 minute read

OS: Windows
Difficulty: Medium
Skills: Enumeration, Kerberoasting, Password Cracking, Tombstone Restore, DPAPI Credential Looting, Privilege Escalation
Tools: rustscan, nmap, nxc, impacket-smbclient, BloodHound, targetedKerberoast, RunasCs, PowerView, office2john, hashcat, LibreOffice, evil-winrm, klist, ssh, scp, impacket-dpapi, impacket-secretsdump

I played the thief (Voleur) in this box and walked away with passwords and secrets: a password-protected Excel file, password hashes, DPAPI-protected credentials and an SSH private key. The chain started with read access to an IT share. That shar...

Artificial

12 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Reverse Shell, Database Looting, Password Cracking, Credential Hunting, SSH Local Port Forwarding, Privilege Escalation
Tools: rustscan, nmap, CVE-2024-3660, revshells, nc, sqlite3, hashcat, ssh

The artificial.htb web application was vulnerable to CVE-2024-3660 in TensorFlow Keras. By uploading a crafted AI model, I triggered the flaw and achieved remote code execution, landing a reverse shell as the app user. An SQLite backend contained...

TombWatcher

24 minute read

OS: Windows
Difficulty: Medium
Skills: Enumeration, ACE Abuse, Kerberoasting, Password Cracking, GMSA Password Read, Tombstone Restore, ESC15, Privilege Escalation
Tools: rustscan, nmap, nxc, bloodhound-python, BloodHound, targetedKerberoast, hashcat, bloodyAD, gMSADumper, impacket-owneredit, impacket-dacledit, evil-winrm

TombWatcher was an interesting machine, focusing heavily on AD ACE abuse through a complex attack chain and ADCS escalation using ESC15. The AD ACE attack chain kicked off with Henry Kerberoasting Alfred. Alfred’s password was laughably weak,...

Puppy

20 minute read

OS: Windows
Difficulty: Medium
Skills: Enumeration, ACE Abuse, SMB Looting, Password Brute-force, Password Spraying, Disclosure of Sensitive Information, DPAPI Credential Looting, Privilege Escalation
Tools: rustscan, nmap, nxc, bloodhound-python, BloodHound, bloodyAD, impacket-smbclient, brutalkeepass, evil-winrm, ncat, impacket-dpapi

Using the supplied engagement credentials, I ran a BloodHound collector against the target Active Directory domain. A BloodHound query revealed an attack path: the user Levi could add himself to the DEVELOPERS group, which granted access to the DE...

Fluffy

22 minute read

OS: Windows
Difficulty: Easy
Skills: Enumeration, ADCS Shadow Credentials, ACE Abuse, ESC16, Privilege Escalation, Password Cracking, Pass-the-Hash, Kerberos
Tools: rustscan, nmap, nxc, impacket-smbclient, impacket-smbserver, net, bloodhound-python, BloodHound, searchsploit, CVE-2025-24071, certipy-ad, hashcat, evil-winrm, klist

An Upgrade Notice document found on a file share contained some information about discovered vulnerabilities in the environment. One of these vulnerabilities was CVE-2025-24071. An exploit Proof of Concept (PoC) generated a malicious zip file, w...

Planning

6 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Web Fuzzing, Reverse Shell, Credential Hunting, Password Reuse, SSH Local Port Forwarding, Privilege Escalation
Tools: rustscan, nmap, ffuf, CVE-2024-9264, nc, ssh, revshells

In this box, I infiltrate an education-themed platform where outdated software and misconfigurations give way to total system compromise. I start with access to a hidden Grafana dashboard vulnerable to CVE-2024-9264, which grants a root shell—but...

Environment

12 minute read

OS: Linux
Difficulty: Medium
Skills: Enumeration, Web Fuzzing, SQL Injection, Authentication Bypass, Arbitrary File Upload, Web Shell, Reverse Shell, Database Looting, Privilege Escalation, Sudo Privilege Exploit, BASH_ENV in non-interactive script
Tools: rustscan, nmap, ffuf, Burp Suite, CVE-2024-52301, revshells, nc, sqlite3, gpg, sudo

A hidden /login page on the Environment web server exposed an SQL injection vulnerability in the remember parameter. The error messages were overly verbose and even revealed a code snippet showing that authentication could be bypassed by simply sw...

TheFrizz

24 minute read

OS: Windows
Difficulty: Medium
Skills: Enumeration, Reverse Shell, Credential Hunting, Password Reuse, Chisel Port Forwarding, Database Looting, Kerberos, Recycle Bin artefact recovery, Password Spraying, GPO Abuse
Tools: rustscan, nmap, CVE-2023-45878, nc, chisel, mysql, hashcat, nxc, bloodhound-python, BloodHound, ssh, scp, impacket-getTGT, SharpGPOAbuse, RunasCs

An outdated Gibbon Learning Management System vulnerable to CVE-2023-45878 allowed me to gain unauthenticated RCE access as w.webservice. The sha256 password hash and salt for user Fiona Frizzle were exfiltrated from the MySQL database. The passw...

Nocturnal

10 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, IDOR, Web Fuzzing, Sensitive Information Disclosure, Code Analysis, Command Injection, Reverse Shell, Database Looting, Password Cracking, SSH Local Port Forwarding
Tools: rustscan, nmap, ffuf, msfvenom, CyberChef, Burp Suite, nc, sqlite3, hashcat, ssh, CVE-2023-46818

Nocturnal starts off slow and quiet — just SSH and HTTP on the radar. But behind the sleepy facade lies a custom file-sharing platform full of secrets and bad decisions. I abused a classic Insecure Direct Object Reference (IDOR) to enumerate user...

Code

9 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Python Code Injection, Reverse Shell, Database Looting, Password Cracking, Privilege Escalation, Sudo Privilege Exploitation
Tools: rustscan, nmap, revshells, nc, sqlite3, hashcat, ssh, scp, sudo

A tiny Python “scratch‑pad” exposed on port 5000 turned out to be a full‑blown shell dispenser. Enumeration showed only SSH and a Flask + Gunicorn Python Code Editor web app. Although the devs blocked obvious strings like import, exec, and subpro...

Cypher

13 minute read

OS: Linux
Difficulty: Medium
Skills: Enumeration, Web Fuzzing, Cypher Injection, Session Hijacking, Command Injection, Reverse Shell, Privilege Escalation, Password Reuse, Sudo Privilege Exploitation
Tools: rustscan, nmap, ffuf, jd-gui, Burp Suite, revshells, nc, sudo, bbot-privesc

“Cypher” was an interesting box that blended web exploitation, graph database query injection, and privilege escalation through a misconfigured tool. The initial foothold was established through Cypher Injection in the login API, which enabled fo...

Dog

8 minute read

OS: Linux
Difficulty: Easy
Skills: Enumeration, Web Shell, Reverse Shell, Password Reuse, Sudo Privilege Exploit, PHP Code Injection, Privilege Escalation
Tools: rustscan, nmap, git-dumper, searchsploit, EDB-ID 52021, revshells, nc, sudo

In the “Dog” machine on Hack The Box, I went sniffing around a poorly secured .git directory and followed the trail all the way to root. Starting with just two open ports, I dug through the exposed Git repo and uncovered credentials hardcoded in ...

Cat

22 minute read

OS: Linux
Difficulty: Medium
Skills: Enumeration, Website Fuzzing, Stored XSS, Session Hijacking, SQL Injection, Password Cracking, Privilege Escalation, SSH Local Port Forwarding, Password Reuse
Tools: rustscan, nmap, ffuf, sqlmap, hashcat, searchsploit, CVE-2024-6886, ssh

The Cat machine was a multi-stage challenge blending classic web vulnerabilities with subtle post-exploitation pivots. The initial foothold came from something many devs overlook—a publicly exposed .git directory. This gifted me the full site so...

Haze

41 minute read

OS: Windows
Difficulty: Hard
Skills: Enumeration, Path Traversal, Username Enumeration, Password Spraying, Kerberos, ACE Abuse, ADCS Shadow Credentials, Privilege Escalation, GMSA Password Read, Pass-the-Hash, Credential Hunting, Reverse Shell
Tools: rustscan, nmap, CVE-2024-36991, splunksecrets, python, username-anarchy, nxc, evil-winrm, SharpHound, BloodHound, ncat, klist, PowerView, impacket-owneredit, impacket-dacledit, pth-net, pywhisker, PKINITtools, revshells, PrintSpoofer, mimikatz, impacket-secretsdump

The Haze machine was compromised by exploiting a chain of vulnerabilities, starting with a Splunk path traversal (CVE-2024-36991), which allowed the retrieval of sensitive files and revealed an LDAP bind password for paul.taylor. This granted ini...