Posts on Pablo Seoane · Pentester & Security Researcher

HTB Walkthrough: GoodGames

Thu, 16 Jul 2026 00:00:00 +0000

Walkthrough of GoodGames on Hack The Box. Easy difficulty machine running Linux. The chain starts with a SQL Injection on the login form that allows both authentication bypass and database dumping. A cracked MD5 hash grants access to an internal Flask admin panel where the username field is vulnerable to SSTI with Jinja2, giving RCE as root inside a Docker container. Exiting to the real host combines credential reuse via SSH with a classic container escape: the user’s home directory is mounted as a volume, and without user namespace remapping the container’s root can plant a SUID bit on bash that is effective on the host.

HackTheBox Linux Easy

HTB Walkthrough: Sau

Mon, 13 Jul 2026 00:00:00 +0000

Walkthrough of Sau on Hack The Box. Easy difficulty machine running Linux. An SSRF in Request Baskets v1.2.1 (CVE-2023-27163) lets us pivot to Maltrail v0.53, a malicious traffic detection service accessible only from localhost. Maltrail has an unauthenticated RCE in its login endpoint that gives us a shell as puma. Escalation to root exploits CVE-2023-26604: systemctl status run via sudo invokes less as a pager inheriting root privileges, which we escape with !/bin/bash.

HackTheBox Linux Easy

HTB Walkthrough: CCTV

Mon, 22 Jun 2026 00:00:00 +0000

Walkthrough of CCTV on Hack The Box. Medium difficulty machine running Linux. ZoneMinder exposed with default credentials is vulnerable to CVE-2024-51482, a blind SQL Injection that lets us extract bcrypt hashes and gain SSH access. Once inside, motionEye runs as root with its API signing key exposed in a readable configuration file — a combination that exploits CVE-2025-60787 to inject a command into a capture filename and set SUID on /bin/bash.

HackTheBox Linux Medium

HTB Walkthrough: Jerry

Sat, 13 Jun 2026 00:00:00 +0000

Walkthrough of Jerry on Hack The Box. Easy difficulty machine running Windows Server 2012 R2. Apache Tomcat 7.0.88 exposed with default credentials in the Manager. We use them to deploy a malicious WAR that delivers remote code execution directly as NT AUTHORITY\SYSTEM — no privilege escalation needed.

HackTheBox Windows Easy

HTB Walkthrough: NetMon

Sat, 13 Jun 2026 00:00:00 +0000

Walkthrough of NetMon on Hack The Box. Easy difficulty machine running Windows Server 2016. Anonymous FTP exposes the Windows root filesystem, allowing us to read a PRTG configuration backup with cleartext credentials. With admin panel access we exploit CVE-2018-9276, a command injection in PRTG’s notification system that executes code as NT AUTHORITY\SYSTEM.

HackTheBox Windows Easy

HTB Walkthrough: Devel

Fri, 12 Jun 2026 00:00:00 +0000

Walkthrough of Devel on Hack The Box. Easy difficulty machine running Windows 7 x86. Anonymous FTP shares the root directory with the IIS webroot, letting us upload an ASPX webshell and gain remote code execution. We escalate to NT AUTHORITY\SYSTEM by exploiting MS10-015 (KiTrap0D), a flaw in the Windows x86 kernel.

HackTheBox Windows Easy

HTB Walkthrough: Facts

Tue, 09 Jun 2026 00:00:00 +0000

Walkthrough of Facts on Hack The Box. Easy difficulty machine running Linux (Ubuntu 25.04). We exploit a Mass Assignment in Camaleon CMS to escalate our role to administrator without knowing any password, abuse a Path Traversal in the AWS uploader to read system files and extract an encrypted SSH key, crack the passphrase with John the Ripper, and escalate to root by abusing sudo NOPASSWD permissions over facter with a malicious custom Ruby fact.

HackTheBox Linux Easy

HTB Walkthrough: Kobold

Mon, 01 Jun 2026 00:00:00 +0000

Walkthrough of Kobold on Hack The Box. Easy difficulty machine running Linux. Exploitation goes through CVE-2026-23744, an unauthenticated RCE in MCPJam Inspector 1.4.2: the /api/mcp/connect endpoint passes the command field directly to child_process.spawn() without any validation. Privilege escalation to root exploits the fact that user ben belongs to the operator group, which has permissions over the Docker socket — accessible via sg docker without needing to log out. With access to the Docker daemon, we mount the host filesystem and get root with chroot.

HackTheBox Linux Easy

HTB Walkthrough: Cap

Tue, 14 Apr 2026 00:00:00 +0000

Walkthrough of Cap on Hack The Box. Easy difficulty machine running Linux (Ubuntu 20.04 LTS). We exploit an IDOR on a network capture download endpoint to obtain cleartext FTP credentials, gain SSH access by reusing the password, and escalate to root by abusing the cap_setuid capability assigned to the Python 3.8 binary.

HackTheBox Linux Easy

HTB Walkthrough: Principal

Tue, 14 Apr 2026 00:00:00 +0000

Step-by-step walkthrough of Principal on Hack The Box. Medium difficulty machine running Linux (Ubuntu 24.04 LTS). We chain a JWT authentication bypass via CVE-2026-29000, credential extraction from an admin dashboard, and privilege escalation to root by forging an SSH certificate with the server’s private CA key.

HackTheBox Linux Medium

HTB Walkthrough: DevArea

Sun, 29 Mar 2026 00:00:00 +0000

Walkthrough of DevArea on Hack The Box. Medium difficulty machine running Linux Ubuntu. A Java SOAP service downloaded via anonymous FTP turns out to be Apache CXF 3.2.14, vulnerable to CVE-2022-46364 (XOP Include LFI). We use the flaw to read Hoverfly credentials from the systemd configuration and get RCE through the Middleware system. Root escalation exploits PATH Hijacking in a script executed with sudo.

HackTheBox Linux Medium

HTB Walkthrough: Blue

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of Blue on Hack The Box. Easy difficulty machine running Windows 7 SP1. The vector is the infamous EternalBlue exploit (MS17-010), a vulnerability in SMBv1 that compromises the Windows kernel and delivers direct access as NT AUTHORITY\SYSTEM with no credentials required.

HackTheBox Windows Easy

HTB Walkthrough: Lame

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of Lame, one of the most classic machines on Hack The Box. Easy difficulty running Linux. The main vector is a remote code execution vulnerability in Samba 3.0.20 (CVE-2007-2447) that, through the way Samba processes usernames, executes arbitrary shell commands with the service’s privileges — in this case, root.

HackTheBox Linux Easy

HTB Walkthrough: WingData

Sat, 28 Mar 2026 00:00:00 +0000

Walkthrough of WingData on Hack The Box. Easy difficulty machine running Linux. RCE via CVE-2025-47812, a null-byte authentication bypass in Wing FTP Server that grants access to the admin panel and remote code execution. After cracking user credentials with hashcat (SHA-256 with salt), we escalate to root by exploiting a PATH_MAX bypass in Python’s tarfile module executed with sudo privileges.

HackTheBox Linux Easy