writeups - Structured technical reports documenting lab-based - 剑庭安 - 网站开发定制 SEO 优化蜘蛛池代做在线看手相算命

项目说明

HTB & THM Writeups — 0N1S3C

> Technical documentation of HackTheBox and TryHackMe machines sol my Information Security degree and red team certification prep.

Structured reports demonstrating methodical penetration testing, pri escalation techniques, and defensi.

Author: (0N1S3C) | Information Security @ THWS Würzburg
HTB Handle: 0N1S3C2 | THM Handle: 0N1S3C
Focus: Red teaming, web exploitation, Acti, Linux/Windows pri escalation
Cert Path: CWES → CWEE → CPTS

---

Boxes Completed

Easy

| Box | Platform | OS | Key Techniques | Date |
|-----|----------|----|----|------|
| CCTV | HTB | Linux | SQLi (C), motionEye command injection, HMAC bypass, sh/bash pitfalls | 2026-03-08 |
| Facts | HTB | Linux | Mass assignment C, S3 credential abuse, sudo facter exploitation | 2026-03-08 |
| WingData | HTB | Linux | Wing FTP unauthenticated RCE (C), tarfile symlink C | 2026-03-09 |
| Eighteen | HTB | Windows DC | MSSQL impersonation, BadSuccessor C, dMSA abuse, Kerberos tunneling | 2026-03-10 |
| Con | HTB | Linux | Source code disclosure, path tra file upload, cronjob hijack, sudo needrestart | 2026-03-08 |
| TwoMillion | HTB | Linux | In abuse, mass assignment, command injection, credential reuse, O C | 2026-03-16 |
| Expressway | HTB | Linux | UDP/IKE aggressive mode enum, offline PSK crack, TFTP config disclosure, credential reuse, sudo proxy policy bypass | 2026-03-15 |
| Kobold | HTB | Linux | MCPJam RCE C, Pri LFI C, bind mount inode persistence, Arcane Docker API privesc | 2026-03-21 |
| Bashed | HTB | Linux | Exposed phpbash webshell, sudo misconfiguration, cronjob hijack | 2026-03-07 |
| Shocker | HTB | Linux | ShellShock C (CGI), sudo perl GTFOBins | 2026-03-07 |
| All In One | THM | Linux | LFI (mail-masta plugin), credential discovery, sudo socat | 2026-02-20 |

Medium

| Box | Platform | OS | Key Techniques | Date |
|-----|----------|----|----|------|
| Cronos | HTB | Linux | DNS zone transfer, SQLi auth bypass, command injection, cronjob hijack | 2026-03-07 |
| Rabbit Store | THM | Linux | Business logic flaw, SSTI (Jinja2), RabbitMQ Erlang cookie abuse | 2026-02-22 |
| CTF Collection Vol.2 | THM | Web Challenges | Multi-layer encoding, cookie tampering, time-based SQLi, HTTP method abuse | Learning exercise |
| Hammer | THM | Linux | Rate limit bypass (X-Forwarded-For), JWT kid exploitation, session-specific code brute force | 2026-03-11 |) | THM | Linux | Rate limit bypass (X-Forwarded-For), JWT kid exploitation, session-specific code brute force | 2026-03-11 |
| Pterodactyl | HTB | Linux | C + PEAR RCE, C/6019 PAM/udisks chain | 2026-03-12 |
| Jarvis | HTB | Linux | SQLi → phpMyAdmin C LFI → Command injection bypass → SUID systemctl | 2026-03-12 |
| Browsed | HTB | Linux | Chrome Extension Upload → SSRF to localhost:5000 → Flask Bash Injection → Reverse Shell (larry) → Python __pycache__ Poisoning | 2026-03-13 |
| Injectics | THM | Linux | mail.log Disclosure → SQLi Auth Bypass → DROP TABLE → Twig SSTI Sandbox Escape (sort Filter) → RCE | 2026-03-14 |
| | HTB | Linux | Exposed Git repo, fontTools arbitrary write C, FontForge filename injection C, sudo Python plugin installer cron abuse | 2026-03-16 |

Hard

| Box | Platform | OS | Key Techniques | Date |
|-----|----------|----|----|------|
| Rabbit Hole | THM | Linux | Second-order SQLi, information_schema.processlist credential interception | 2026-03-09 |

---

Report Structure

Each writeup follows a standardized format:

Executi — High-le and impact assessment

Attack Chain — flow from reconnaissance to root

Detailed Walkthrough — Step-by-step technical analysis with commands and reasoning

Findings Table — with se ratings (Critical/High/Medium/Low/Info)

Defensi — IOCs, hardening recommendations, detection opportunities

Lessons Learned — Technical insights and methodology impro

See METHODOLOGY.md for the full assessment framework.

---

Methodology Highlights

Enumeration-first approach — exhausti discovery before exploitation attempts

Source code analysis — read actual implementation when documentation isn't enough

Defensi — every exploit includes detection & hardening guidance

Documentation rigor — reproducible steps, sanitized outputs, proper C

Root cause analysis — understand *why* exist, not just *how* to exploit them

---

Key Lessons Learned (So Far)

Technical Insights

Motion uses /bin/sh not /bin/bash — reverse shell redirect operators matter; >& fails in sh (CCTV)

Wrong breaks e — Starting Point ≠ Labs VPN, always before troubleshooting (Facts)

Read the exploit source code — parameter names matter; password[role] not user[role] (Facts)

HMAC keys can be hashes themselves — don't always need plaintext passwords (CCTV)

--custom-dir bypasses env — blocking FACTERLIB doesn't help when CLI flags exist (Facts)

Port 88 filtering requires creati — chisel + socat for Kerberos over SSH (Eighteen)

BadSuccessor is absurdly powerful — CreateChild on any OU = domain admin on WS2025 (Eighteen)

Vhost enum isn't always the answer — sometimes it's just in the page source (WingData)

Static salts are almost as bad as no salts — "WingFTP" for every user means standard wordlist attacks work perfectly (WingData)

filter="data" is not sufficient — C shows Python's tarfile filter doesn't protect against symlink+hardlink chaining (WingData)

PBKDF2 at 600k iterations defeats GPU cracking — hashcat was impractical, custom CPU-based Python script was the correct tool (Eighteen)

Enumeration & Methodology

Gobuster extensions matter — using -x sh,cgi,pl finds scripts that default scans miss (Shocker)

Port 53 is an attack surface — DNS zone transfer hands you the entire subdomain structure instantly (Cronos)

Source code disclosure is critical — entire attack chains can start with downloading exposed archives (Con)

Second-order SQLi requires patience — injection fires at query time, not insert time (Rabbit Hole)

Double quotes matter — single-quoted injection sanitized, /" prefix bypassed it (Rabbit Hole)

information_schema.processlist is a real attack surface — o DB users expose li including credentials (Rabbit Hole)

Pri Escalation Patterns

Cronjob hijacking appears E — Bashed, Cronos, Con all used this; always check /etc/crontab and writable script directories

GTFOBins for sudo privesc — sudo + unusual binary = check GTFOBins immediately (Shocker, All-in-One, Con)

File ownership reveals who runs scripts — test.txt owned by root despite script owned by scriptmanager = root runs it (Bashed)

Rabbit Holes & Mindset

The box name is the hint — "Rabbit Hole" literally told us to avoid o (Rabbit Hole)

Don't stop at the first working — exploring alternati solving teaches the most

Difficulty ratings don't always match reality — "Easy" boxes can require MSSQL chains, custom hash cracking, and 2025 CVEs (Eighteen)

---

Stats

HTB: Hacker 14 boxes solved (11 Easy, 3 Medium, preparing for more Medium/Hard)

THM: Top 1%, Gold League #1 (1,069 points), 211+ rooms completed (including 3 documented challenge boxes)

Current Goal: CWES certification → CWEE → CPTS path

Training Focus: Red teaming, pri escalation, Acti attacks

---

Disclaimer

All acti documented in this repository were conducted exclusively within authorized lab en (HackTheBox and TryHackMe). No real-world systems were accessed or harmed. Flags and sensiti have been redacted from all reports.

---

Contact

HTB Profile: 0N1S3C2

THM Profile: 0N1S3C

Location: Würzburg, Germany

Uni: THWS Würzburg (Bachelor of Information Security)

---

*"Always the before troubleshooting connectivity for 30 minutes." — Lessons learned the hard way*

Updated Thu Mar 22 22:49:00 CET 2026

项目信息

开发语言：SCSS

Star 数：3

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Structured technical reports documenting lab-based offensive security assessments. Covers reconnaissance, exploitation, privilege escalation, and defensive analysis.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。

登录后才能参与讨论

下载链接

会员才能下载

登录后开通会员

同分类推荐

暂无同类资源

资源标题	writeups - Structured technical reports documenting lab-based
所属分类	防护思路
发布作者	admin
发布时间	2026-10-06 00:17:02
下载权限	免费下载
附件数量	2 个下载链接
浏览次数	368
讨论数量	0
主题状态	正常讨论中

writeups - Structured technical reports documenting lab-based