#993active
read writeup →Writeup Matrix
Browse through machines I've pwned. Filter writeups by retirement status, OS, difficulty, or season.
6/16writeups selected
#990active
read writeup →
#987active
read writeup →
#984active
read writeup →
#963active
read writeup →
#978active
read writeup →
#975active
read writeup →
#930active
read writeup →
#957retired
Fireflow is a medium Linux machine featuring a Langflow AI agent platform vulnerable to CVE-2026-33017, unauthenticated RCE via exec() injection to gain a foothold, Langflow superuser credentials leaked from the process environment for lateral movement, a JWT alg:none bypass against an MCP Tool Registry for code execution inside a Kubernetes pod, and kubelet WebSocket exec via nodes/proxy RBAC against a privileged node-exporter pod with the host filesystem mounted for root.
#curl#cve-2026-33017#exec-injection#host-filesystem-escape#htb-standalone#jwt-none-algorithm#kubelet-exec#kubernetes#langflow#mcp-tool-registry#netcat#nmap#node-exporter#nodes-proxy#password-reuse#pty-upgrade#rce#reverse-shell#sudo-abuse#suid-abuse
read writeup →#948retired
Nexus is an easy Linux machine featuring a Gitea instance that leaks a legacy password in its commit history, a Krayin CRM login vulnerable to authenticated RCE via TinyMCE uploads (CVE-2026-38526) for a foothold as www-data, reused .env credentials to pivot to jones, and a root-run Gitea template-sync script whose unsanitized os.path.join enables a Git path-traversal write to root's authorized_keys.
#cve-2026-38526#ffuf#git-history-leak#gitea#htb-standalone#krayin-crm#netcat#nmap#os-path-join#password-reuse#path-traversal#pty-upgrade#rce#reverse-shell#seclists#tinymce-upload
read writeup →#909active
read writeup →
#906active
read writeup →
#736retired
Expressway is an easy Linux machine featuring an IKE/IPsec VPN endpoint that leaks an aggressive-mode pre-shared key, offline IKE-PSK SHA1 cracking for SSH access as the ike user, and a vulnerable sudo version (CVE-2025-32463) leading straight to root.
#cve-2025-32463#hashcat#hostname-bypass#htb-s09-gacha#ike-aggressive-mode#ike-psk-cracking#ipsec#nmap#sudo-abuse
read writeup →#636retired
Alert is an easy Linux machine featuring a markdown viewer with stored cross-site scripting, an admin-only page vulnerable to arbitrary file read used to steal an .htpasswd hash, cracked credentials for SSH, and a group-writable PHP config served by root for privilege escalation.
#apr1-md5#arbitrary-file-read#cross-site-scripting#curl#ffuf#group-writable-config#hashcat#htb-standalone#htpasswd-cracking#insecure-file-permissions#markdown-viewer#netcat#nmap#path-traversal#php-code-injection#python-http-server#reverse-shell#seclists#sudo-abuse#xss
read writeup →#608retired
Editorial is an easy Linux machine featuring a book-publishing web app vulnerable to server-side request forgery, an internal Flask API leaking dev credentials, plaintext credentials in git history for lateral movement, and a GitPython RCE (CVE-2022-24439) via a root sudo script for privilege escalation.
#credential-disclosure#curl#cve-2022-24439#flask-api#git-history#gitpython#htb-s05-anomalies#netcat#nmap#remote-code-execution#ssrf#sudo-abuse
read writeup →#603retired
BoardLight is an easy Linux machine featuring a Dolibarr CRM/ERP instance vulnerable to CVE-2023-30253, PHP code injection to gain a foothold, reused database credentials to pivot laterally, and an Enlightenment SUID abuse (CVE-2022-37706) for privesc.
#cve-2022-37706#cve-2023-30253#default-credentials#dolibarr#enlightenment#ffuf#htb-s05-anomalies#netcat#nmap#password-reuse#path-traversal#php-code-injection#pty-upgrade#reverse-shell#seclists#sudo-abuse#suid-abuse
read writeup →No machines match the selected tags.