Exploit the Blazor framework for Windows web app and SPN hijack.

The most insane Windows box on HTB.

Create a malicious Excel XLL to phish via emails.

The most insane Linux box on HTB.

Season V, Linux, Easy, Git, CVE-2022-24439, SSRF

USER Nmap does not give us much information but a domain: Then I went for subdomain enumeration to dig out more useful information using ffuf: We have 3 subdomain entries: The &

Fake a 0x10001 chunk on the Tcache metadata.

This is a game of Attack on Titan (進撃の巨人), a love story between Mikasa and Eren. Let’s start from the day when the Titans comes … WEB ADMIN Nmap for port scanning: P

CVE-2023-30253 for Dolibarr & CVE-2022-37706 for Enlightment

TL;DR The HTB team requires this writeup not to be public. If you want to access the newly updated password for the writeups, you are welcome to join the discord with the entran