HackTheBox-scripts - Useful scripts to exploit Hack The Box retired mac

项目说明

Hack The Box scripts

This repository is made to upload some custom interesting scripts in different programming languages that are useful to exploit certain in Hack The Box retired machines/challenges.

Detailed write-ups are posted on my personal blog: and

For every machine/challenge, there is a README.md file that explains how the script is built, giving some reasons why and doing some troubleshooting if necessary.

The aim of this repository is to provide useful scripts that can be adapted to other circumstances and show how some techniques can be performed using a certain programming language.

Hope it is useful! :smile:

Machines

| Machine | Scripts / Programs | Language | Purpose |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Alert | lfr.py | Python | Local File Read with Directory Tra XSS and CSRF |
| Altered | bf_pin.rb | Ruby | Brute Force attack on a 4-digit PIN |
| Antique | decode.py | Python | Decoding a password from SNMP |
| Awkward | readFile.js | Node.js | Read files from the ser a malicious JWT payload |
| Backdoor | dpt.py<br>pwn_gdbserver.py | Python<br>Python | Read files using Diretory Path Tra<br>Obtain a reverse shell via GNU gdbserver |
| Bizness | ofbiz_exploit.sh | Bash | Authentication bypass. Automate the process to exploit a deserialization attack in Java |
| BountyHunter | xxe.sh | Bash | Read files using an XXE attack |
| Forge | ssrf.py | Python | Automate a SSRF explotation through an URL |
| GoodGames | autopwn.py | Python | Compromise the machine from scratch to root |
| Hancliffe | decrypt.sh<br>encrypt1.c<br>encrypt2.c<br>exploit.py | <br>Bash<br>C<br>C<br>Python | Decrypt password using brute force<br>ROT47 cipher<br>Atbash cipher<br>Stack-based Buffer O exploit using Socket Reuse |
| Health | ssrf.py<br>crack.go | Python<br>Go | Perform a SSRF attack using a redirection with Flask<br>Crack Gogs hash |
| Horizontall | rce_strapi.py | Python | Chain two exploits for Strapi to obtain a reverse shell |
| Intelligence | reqPdf.go | Go | Fuzz for PDF files with a guessable filename |
| Intentions | get_file.c | C | Extract file with MD5 hash oracle |
| Monitors | deserialization.sh | Bash | Automate the process to exploit a deserialization attack in Java |
| NodeBlog | nosqli.sh<br>xxe.py<br>unserialize_rce.js | Bash<br>Python<br>Node.js | Extract password using RegEx in a NoSQL injection<br>Read files using an XXE attack<br>Obtain a reverse shell exploiting an insecure deserialization |
| O | get_admin_token.py<br>extract_id_rsa.py<br>bf_token.py<br>exploit_rce.py<br>exploit_write.py | Python<br>Python<br>Python<br>Python<br>Python | Obtain adminToken chaining CSRF through Open Redirect and AngularJS XSS to access localStorage<br>Read id_rsa exploiting ffmpeg SSRF<br>Brute force attack to obtain a valid token<br>Binary exploit to obtain RCE as root<br>Binary exploit to obtain write permissions as root |
| Pikaboo | autopwn.py | Python | Compromise the machine from scratch to root |
| Precious | autopwn.rb | Ruby | Compromise the machine from scratch to root |
| Previse | foothold.go | Go | Register a new account and obtain a reverse shell exploiting a command injection |
| RainyDay | extract_file.py<br>extract_pepper.py<br>crack.py | Python<br>Python<br>Python | Extract file byte by byte using RegEx<br>Abuse bcrypt limitations to extract secret pepper using emoji<br>Crack bcrypt hash with secret pepper |
| Retired | first_exploit.py<br>second_exploit.py<br>third_exploit.py | Python<br>Python<br>Python | Buffer O. PIE and ASLR bypass. NX bypass (ROP). ret2libc with custom command. Brute force<br>Buffer O. PIE and ASLR bypass. NX bypass (ROP). ret2libc with custom command. Write-what-where primitive<br>Buffer O. PIE and ASLR bypass. NX bypass (mprotect + shellcode) |
| Rope | fmtstr_exploit.py<br>root_exploit.py | Python<br>Python | Format String exploitation<br>Buffer O. PIE and Canary bypass (brute force). NX bypass (ROP). ASLR bypass (leaks). ret2libc through socket |
| Scanned | exploit.sh<br>crack.go | Bash<br>Go | Read files and list directories by uploading a custom binary that escapes from a sandbox en<br>Crack Django salted MD5 hash |
| Shared | sqli.js | Node.js | Union-based SQLi exploitation inside a cookie |
| Soccer | websocket_sqli.py | Python | Dump database contents using a Boolean-based SQLi from a WebSocket server |
| Spider | ssti.py<br>xxe.sh | Python<br>Bash | Performing an SSTI on Jinja2<br>Read files as root using an XXE attack |
| Static | get_vpn.rb<br>xdebug_shell.py<br>exploit.py | Ruby<br>Python<br>Python | Downloading a a TOTP and a Gzip file patch<br>Obtain a reverse shell for xdebug in a PHP server<br>Binary exploitation using a Format Strings |
| Stocker | nosqli_regex.py | Python | Extract fields from a NoSQL database using NoSQLi and RegEx |
| Timing | upload.py | Python | Manage to upload a PHP web shell and provide the URL to access it |
| Unicode | dpt-jwks.py | Python | Interacti to read files from the server Path Tra and serve a JWKS to interact with the website as admin |
| Union | UnionSQLi.java | Java | Interacti to make SQL queries using a Union-based SQLi |
| UpDown | php_execute.py | Python | Execute PHP code abusing a file upload |
| Writer | sqli.py<br>foothold.py | Python<br>Python | Dump database contents and read files using a Boolean-based SQLi<br>Obtain a reverse shell using a command injection via file upload |

Challenges

| Crypto | Scripts / Programs | Language | Purpose |
| ------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| 400curves | solve.py | Python / SageMath | ECC. Invalid Cur |
| AbraCryptabra | solve.py | Python / SageMath | Truncated LCG. AES. Knapsack. LLL lattice reduction |
| AESWCM | solve.py | Python | Custom encryption using AES and XOR |
| AHS512 | solve.py | Python | Custom hash function. Bit operations |
| Android-in-the-Middle | solve.py | Python | Diffie-Hellman. MITM |
| baby quick maffs | solve.py | Python | Related messages attack. Modular arithmetic |
| Bank-er-smith | solve.py | Python / SageMath | RSA. Known bits. Coppersmith method |
| BBGun06 | solve.py | Python | RSA. Forge signature. Regular Expression bypass |
| BFD56 | solve.c | C | CBC Bifid cipher |
| Biased Heritage | solve.py | Python / SageMath | Schnorr signature. Hidden Number Problem. LLL lattice reduction |
| Blessed | solve.py | Python / SageMath | BLS12-381. BLS signatures. Rogue key attack. Zero-knowledge proof. EC-LCG. LLL lattice reduction |
| Bloom Bloom | solve.py | Python / SageMath | AES. Shamir Secret Sharing |
| Clutch | solve.py | Python | Quantum Criptography. Frame-based Quantum Key Distribution |
| Colliding Heritage | solve.py | Python | Schnorr signature. MD5 collision |
| Composition | solve.py | Python / SageMath | Close primes. RSA and ECC. Finding cur. Elliptic curve o modulus |
| Con | solve.py | Python / SageMath | ECC. Binary search. Finding cur. Smart's attack. PRNG |
| Copperbox | solve.sage | SageMath | Truncated LCG. Coppersmith method on a bi polynomial |
| CryptoConundrum | solve.py | Python | AES cipher. Frequency analysis. Depth-first search |
| Digital Safety Annex | solve.go | Go | DSA. Brute force |
| Down the Rabinhole | solve.py | Python | GCD. Modular arithmetic. Padding |
| Elliptic Labyrinth | solve.py | Python / SageMath | ECC. Finding cur |
| Fibopadcci | solve.py | Python | Padding Oracle Attack. Custom cipher and padding |
| Find Marher's Secret | solve.py | Python | RC4. FMS attack |
| Hash the Filesystem | solve.py | Python | AES CTR. Inverse function of the Python built-in hash function |
| Homomurphy's Law | solve.py | Python | Homomorphic encryption. XOR cipher. AES cipher. Brute force |
| How The Columns Ha | solve.py | Python | Reverse encryption algorithm |
| hybrid unifier | solve.py | Python | E2E encryption. Diffie-Hellman. AES |
| I know Mag1k | solve.py | Python | DES. Padding Oracle Attack. |
| Infinite Descent | solve.py | Python | RSA. Close primes. PRNG |
| Infinite Knapsack | solve_bf.py<br>sol.py | Python<br>Python / SageMath | Knapsack. Brute force. Unshuffling<br>Knapsack. LLL lattice reduction. Unshuffling |
| Interception | solve.py | Python / SageMath | RSA. GCD. Coppersmith method. Euler's Theorem |
| Jenny From The Block | solve.py | Python | Block cipher. SHA256 |
| Living with Elegance | solve.go | Go | Learning With Errors. Probabilistic oracle |
| LunaCrypt | solve.py | Python | Reverse encryption algorithm based on binary operations |
| MSS | solve.py | Python | Mignotte Secret Sharing. Modular arithmetic. Chinese Remainder Theorem |
| Mind In The Clouds | solve.py | Python / SageMath | ECDSA. Partially-known nonces. LLL lattice reduction |
| Not that random | solve.go | Go | HMAC. Hash functions |
| One Step Closer | solve.sage | SageMath | RSA. Franklin-Reiter related-message attack |
| Optimus Prime | solve.py | Python | RSA. Greatest Common Divisor |
| Oracle Leaks | solve.go | Go | RSA. Manger's attack |
| Partial Tenacity | solve.py | Python | RSA. Partially-known private information. Modular arithmetic |
| Quadratic Points | solve.py | Python / SageMath | Integer linear relations. LLL lattice reduction. ECDLP. CRT |
| quick maffs | solve.py | Python / SageMath | RSA. Low Exponent with Related messages attack. Groebner basis. Brute force |
| RLotto | solve.py | Python | PRNG. Time-based seed |
| Roulette | solve.py | Python / SageMath | PRNG. Custom Mersenne Twister. System of equations with binary |
| Secure Signing | solve.go | Go | Hash function. XOR. Oracle |
| secure source | solve.py | Python | JWT. ECDSA. Python random state |
| Signing Factory | solve.py | Python | Modular arithmetic. RSA signature. Malleability |
| signup | solve.py | Python | DSA. Nonce reuse. Modular arithmetic |
| Space Pirates | solve.py | Python | Shamir Secret Sharing. PRNG seed |
| SPG | solve.py | Python | Boolean oracle |
| The Three-Eyed Oracle | solve.py | Python | AES ECB oracle |
| Tsayaki | solve.py | Python | TEA. Equi keys. CBC mode |
| TurboCipher | solve.py | Python | Recurrence relation. Telescoping series. LCG |
| Twin Oracles | solve.py | Python | RSA. PRNG. LSB and MSB oracles |
| TwoForOne | solve.py | Python | RSA. Common modulus attack |
| | solve.py | Python / SageMath | RSA PKCS#1 v1.5. Padding Oracle. Bleichenbacher attack. Hidden Number Problem. LLL lattice reduction |
| Waiting List | solve.py | Python / SageMath | ECDSA. Nonces with known bits. Hidden Number Problem. LLL lattice reduction |
| Zombie Rolled | solve.py | Python / SageMath | Fractions. Diophantine equation solution with elliptic curve. RSA signature. LLL lattice reduction. Groebner basis |

| Forensics | Scripts / Programs | Language | Purpose |
| ------------------------------------------------------------------- | ---------------------------------------------------------------- | -------- | ----------------------------------------- |
| Deadly Arthropod | solve.py | Python | USB HID key strokes parser |
| Halloween In | solve.py | Python | Microsoft Office deobfuscation |

| Hardware | Scripts / Programs | Language | Purpose |
| -------------------------------------- | ----------------------------------------------------- | -------- | ----------------------------------------------------------------------- |
| HM74 | solve.py | Python | Noisy channel. Hamming codes. Statistically find correct message blocks |
| | solve.py | Python | Print possible inputs for XOR encryption |

| Misc | Scripts / Programs | Language | Purpose |
| -------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- | -------------- | ---------------------------------------------------------------- |
| A Nightmare on Math Street | solve.go | Go | Uncon math arithmetics |
| Branching Tactics | solve.go | Go | Path-finding. Breadth-first Search |
| Computational Recruiting | solve.py | Python | Text processing. Math operations |
| Deterministic | solve.py | Python | Decryption process automation. XOR cipher |
| Emdee five for life | solve.py<br>solve.sh | Python<br>Bash | Compute and send MD5 hash of a string as quickly as possible |
| Eternal Loop | solve.go | Go | Uncompress ZIP archi |
| ExploitedStream | solve.js | Node.js | Brute force package name to decrypt AES |
| Fentastic Moves | solve.py | Python | Chess. FEN string. Stockfish |
| Insane Bolt | solve.py | Python | Depth First Search (DFS) |
| M0rsarchive | solve.py | Python | Morse code. Computer . ZIP files. Automation |
| Path of Survival | solve.py | Python | Path-finding. Breadth-first Search. Dijkstra's algorithm |
| SecretRezipe | solve.py | Python | ZIP compression. BREACH / CRIME attacks. Known plain text attack |
| Thief | solve.py | Python | PCAP extraction. AES cipher. Tree sort |
| Triangles | solve.py | Python | Geometry in the plane. Euclidean distance |
| Type Exception | solve.py | Python | Python jail. Oracle |

| OSINT | Scripts / Programs | Language | Purpose |
| ------------------------------------------- | ----------------------------------------------------- | -------- | ------------------------------------------------------------------------------------ |
| Monstrosity | analyze.py | Python | Use Twitter's API to extract coordinates from tweets and plot them with matplotlib |

| Pwn | Scripts / Programs | Language | Purpose |
| ----------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------- |
| Ancient Interface | solve.py | Python | Buffer O. ret2libc |
| Antidote | solve.py | Python | ARM 32-bit. Buffer O. Ret2csu. ret2libc |
| Auth-or-out | solve.py | Python | Integer O. Heap O. ret2libc |
| Bat Computer | solve.py | Python | Buffer O. Shellcode |
| Blacksmith | solve.py | Python | seccomp rules. open-read-write shellcode |
| Bon-nie-appetit | solve.py | Python | Heap exploitation. Off-by-one. O chunks. Tcache poisoning |
| Control Room | solve.py | Python | OOB write. GOT o |
| CRSid | solve.py | Python | Heap exploitation. Safe-linking. Out-of-bounds write. Tcache poisoning. Exit handlers |
| Dead or Alive | solve.py | Python | Heap exploitation. House of Spirit. Heap _feng-shui_. O chunks. Tcache poisoning. TLS-storage dtor_list |
| Dragon Army | solve.py | Python | Heap exploitation. Fast Bin dup. Messing with main_arena |
| Dream Diary: Chapter 1 | solve.py | Python | Heap exploitation. Off-by-one. Fast Bin attack. Unsafe Unlink |
| Dream Diary: Chapter 2 | solve.py | Python | Heap exploitation. Null byte poisoning. O chunks |
| Dream Diary: Chapter 3 | solve.py | Python | Heap exploitation. Null byte poisoning. O chunks. Tcache poisoning. ROP chain. seccomp rules |
| echoland | dump.py<br>solve.py | Python | Dump binary instructions using a Format String <br>Blind Format String. Buffer O. ret2libc |
| Entity | solve.py | Python | Union structure. Type confusion |
| Fake Snake | solve.py | Python | Python internals. Fake object primitive |
| FileStorage | solve.py | Python | Buffer O. Format String . FILE structure attack. GOT o |
| Finale | solve.py | Python | open-read-write ROP chain |
| Fleet Management | solve.py | Python | seccomp rules. Custom shellcode |
| Format | solve.py | Python | Format String exploitation |
| Great Old Talisman | solve.py | Python | OOB write. Partial GOT o |
| Hellhound | solve.py | Python | Heap exploitation. House of Spirit |
| HTB Console | solve.py | Python | Buffer O. ret2libc |
| knote | solve.c | C | Kernel exploitation. Heap exploitation. Double free. seq_operations. ret2user |
| Leet Test | solve.py | Python | Format String exploitation |
| Math Door | solve.py | Python | Heap exploitation. Heap _feng shui_. Tcache poisoning. FILE structure attack |
| Maze of Mist | solve.py | Python | 32-bit binary. Buffer O. vDSO ROP. sys_execve |
| Nightmare | solve.py | Python | Format String exploitation. GOT o |
| No Return | solve.py | Python | JOP. sys_rt_sigreturn and sys_execve |
| Nowhere to go | dump.py<br>solve.py | Python | Buffer O. Dump vDSO<br>Buffer O. vDSO ROP. sys_execve. seccomp rules |
| Old Bridge | solve.py | Python | Buffer O. Brute force. Stack Pivot. ret2libc |
| Optimistic | solve.py | Python | Buffer O. Integer O. Alphanumeric shellcode |
| Oxidized ROP | solve.py | Python | Rust binary. Unicode characters. Local modificacion |
| Picture Magic | solve.py | Python | Heap exploitation. Heap _feng shui_. House of Einherjar. Format String |
| PwnShop | solve.py | Python | Buffer O. PIE and ASLR bypass. Special ROP chain. ret2libc |
| Regularity | solve.go | Go | Buffer O. ret2reg. Shellcode |
| ReplaceMe | solve.py | Python | Buffer O. PIE and ASLR bypass. ret2libc |
| Robot Factory | solve.py | Python | Buffer O. Threads. Canary bypass. ret2libc |
| Sacred Scrolls: Revenge | solve.py | Python | Buffer O. ret2libc |
| Shooting star | solve.py<br>sol.py | Python | Buffer O. ASLR bypass. ret2libc |
| Space | solve.py | Python | 32-bit binary. Buffer O. Custom shellcode |
| Space pirate: Going Deeper | solve.py | Python | Buffer O. One byte o |
| Space pirate: Retribution | solve.py | Python | Buffer O. ret2libc. Bypass PIE and ASLR |
| Spellbook | solve.py | Python | Heap exploitation. Use After Free. Fast Bin attack |
| Spooky Time | solve.py | Python | Format String exploitation. GOT o |
| Trick or Deal | solve.py | Python | Heap exploitation. Use After Free |
| | solve.py | Python | Bug abuse. XOR cipher |
| Void | solve.py | Python | Buffer O. ret2dlresolve |
| Zombiedote | solve.py | Python | Heap exploitation. OOB read and write. Integer O. Floating-point numbers. TLS-storage dtor_list |
| Zombienator | solve.py | Python | Heap exploitation. Buffer O. Floating-point numbers. Canary bypass. ret2libc. Oracle |

| Re | Scripts / Programs | Language | Purpose |
| ------------------------------------------------------- | ------------------------------------------------------------- | -------- | --------------------------------------------------------------------------- |
| Headache | solve.py | Python | Bypass sys_ptrace. Automate flag extraction from GDB |
| Potion Master | solve.py | Python | z3 solution to a set of conditions |
| Rebuilding | solve.py | Python | Automate flag extraction from GDB |
| Spooky License | solve.py | Python | z3 solver |
| The Vault | solve.py | Python | Automate flag extraction from GDB |
| Up a Stream | Solve.java | Java | Reverse encryption algorithm using functional programming with Ja |

| Web | Scripts / Programs | Language | Purpose |
| --------------------------------------------------------- | -------------------------------------------------------- | -------- | ------------------------------------------------------------------------- |
| 0xBO | solve.go | Go | Transfer-Encoding chunked. Boolean-based SQLi. Automate flag extraction |
| AbuseHumanDB | solve.py | Python | XSS. SOP bypass |
| baby ninja jinja | ssti.py | Python | SSTI. RCE. Limited interacti session |
| BatchCraft Potions | solve.py | Python | GraphQL batching attack. Send XSS and DOM Clobbering payload |
| Breaking Bank | solve.py | Python | Open Redirect. JWKS and JWT forgery. OTP bypass |
| E.Tree | solve.go | Go | XPATH injection. Automate flag extraction |
| emoji | solve.js | Node.js | Boolean-based SQLi in ORDER. Automate flag extraction |
| ExpressionalRebel | redos.go | Go | SSRF. ReDoS. Find the flag back and forth |
| wafwaf | solve.js | Node.js | PHP. Time-based SQL injection. WAF bypass |
| Wild Goose Hunt | solve.go | Go | MongoDB. NoSQLi. Automate flag extraction |

项目信息

开发语言：Python

Star 数：68

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Useful scripts to exploit Hack The Box retired machines/challenges展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。