https://shadowcat.sh/Offensive cybersecurity walkthroughs for Hack The Box and cheatsheets, from enumeration to root & beyond.en-ussh4dowc4tsh4dowc4tSat, 22 Aug 2026 00:00:00 +0000https://shadowcat.sh/htb/writeups/nexus/https://shadowcat.sh/htb/writeups/nexus/Sat, 22 Aug 2026 00:00:00 +0000Nexus is an easy Linux machine featuring a Gitea instance that leaks a legacy password in its commit history, a Krayin CRM login vulnerable to authenticated RCE via TinyMCE uploads (CVE-2026-38526) for a foothold as www-data, reused .env credentials to pivot to jones, and a root-run Gitea template-sync script whose unsanitized os.path.join enables a Git path-traversal write to root's authorized_keys.cve-2026-38526ffufgit-history-leakgiteahtb-standalonekrayin-crmnetcatnmapos-path-joinpassword-reusepath-traversalpty-upgradercereverse-shellsecliststinymce-uploadhttps://shadowcat.sh/htb/writeups/fireflow/https://shadowcat.sh/htb/writeups/fireflow/Tue, 11 Aug 2026 00:00:00 +0000Fireflow is a medium Linux machine featuring a Langflow AI agent platform vulnerable to CVE-2026-33017, unauthenticated RCE via exec() injection to gain a foothold, Langflow superuser credentials leaked from the process environment for lateral movement, a JWT alg:none bypass against an MCP Tool Registry for code execution inside a Kubernetes pod, and kubelet WebSocket exec via nodes/proxy RBAC against a privileged node-exporter pod with the host filesystem mounted for root.curlcve-2026-33017exec-injectionhost-filesystem-escapehtb-standalonejwt-none-algorithmkubelet-execkuberneteslangflowmcp-tool-registrynetcatnmapnode-exporternodes-proxypassword-reusepty-upgradercereverse-shellsudo-abusesuid-abusehttps://shadowcat.sh/htb/writeups/expressway/https://shadowcat.sh/htb/writeups/expressway/Fri, 26 Sep 2025 00:00:00 +0000Expressway is an easy Linux machine featuring an IKE/IPsec VPN endpoint that leaks an aggressive-mode pre-shared key, offline IKE-PSK SHA1 cracking for SSH access as the ike user, and a vulnerable sudo version (CVE-2025-32463) leading straight to root.cve-2025-32463hashcathostname-bypasshtb-s09-gachaike-aggressive-modeike-psk-crackingipsecnmapsudo-abusehttps://shadowcat.sh/htb/writeups/editorial/https://shadowcat.sh/htb/writeups/editorial/Mon, 25 Nov 2024 00:00:00 +0000Editorial is an easy Linux machine featuring a book-publishing web app vulnerable to server-side request forgery, an internal Flask API leaking dev credentials, plaintext credentials in git history for lateral movement, and a GitPython RCE (CVE-2022-24439) via a root sudo script for privilege escalation.credential-disclosurecurlcve-2022-24439flask-apigit-historygitpythonhtb-s05-anomaliesnetcatnmapremote-code-executionssrfsudo-abusehttps://shadowcat.sh/htb/writeups/alert/https://shadowcat.sh/htb/writeups/alert/Sat, 23 Nov 2024 00:00:00 +0000Alert is an easy Linux machine featuring a markdown viewer with stored cross-site scripting, an admin-only page vulnerable to arbitrary file read used to steal an .htpasswd hash, cracked credentials for SSH, and a group-writable PHP config served by root for privilege escalation.apr1-md5arbitrary-file-readcross-site-scriptingcurlffufgroup-writable-confighashcathtb-standalonehtpasswd-crackinginsecure-file-permissionsmarkdown-viewernetcatnmappath-traversalphp-code-injectionpython-http-serverreverse-shellseclistssudo-abusexsshttps://shadowcat.sh/htb/writeups/boardlight/https://shadowcat.sh/htb/writeups/boardlight/Thu, 21 Nov 2024 00:00:00 +0000BoardLight is an easy Linux machine featuring a Dolibarr CRM/ERP instance vulnerable to CVE-2023-30253, PHP code injection to gain a foothold, reused database credentials to pivot laterally, and an Enlightenment SUID abuse (CVE-2022-37706) for privesc.cve-2022-37706cve-2023-30253default-credentialsdolibarrenlightenmentffufhtb-s05-anomaliesnetcatnmappassword-reusepath-traversalphp-code-injectionpty-upgradereverse-shellseclistssudo-abusesuid-abuse