Writeups
Technical deep-dives, research notes, and post-mortems. Lotta boxes from studying for the OSCP.
Hack The Box: Sauna Write-up
I needed this cause I gotta learn AD so bad. Sauna is an easy Active Directory box that walks the classic domain attack chain end to end, from a list of employees on a website all the way to a full domain…
Proving Grounds: Nagoya Write-up
A full Active Directory marathon. Season-based password spraying gets a foothold, Kerberoasting and a GenericAll chain walk us to WinRM, and when SQL won't cooperate we forge a silver ticket to become the Administrator…
Proving Grounds: Vault Write-up
An Active Directory box that starts with a wide-open SMB share you can write to. That write turns into a captured hash, the hash turns into a login, and BloodHound turns a boring user into a Domain Policy rewrite…
Proving Grounds: Access Write-up
What an interesting box! Labeled as an AD box on Lainkusanagi’s OSCP prep list, it goes over a GREAT attack path from a file injection, leading to a low…
Proving Grounds: Spider Society Write-up
Honestly one of my favorite attack paths on Proving Grounds. It starts with a subdomain I fumbled for half an hour, runs through an admin panel that just hands out FTP creds, and ends on a systemd service where the unit file matters more than the script…
Proving Grounds: BitForge Write-up
Probably my hardest root. Honestly one of the best labs I’ve done in preparation for the OSCP, as it was identical to another PEN-200 course lab that I…
Proving Grounds: Exfiltration walk-through
What a great box. It’s definitely earned it’s rank of easy, the foothold is a simple public exploit on the login page for a startup website. The priv esc is…
Proving Grounds: Fish Write-up
This box definitely teaches a lot about enumeration. It’s a windows box that opens up with a website vulnerable to a directory traversal. Enumerating the…
Proving Grounds: Bratarina write up
Using netcat to validate SMTP users on a mail server
Proving Grounds: Kevin
A Windows box from the lainkusanagi OSCP Practice list — default-credential enumeration and a buffer overflow in the HP Power Manager service.
Proving Grounds: Pelican Write-up
A Linux box with a whole zoo of services on it. The way in is an Exhibitor for ZooKeeper instance that happily runs whatever you shove in its config, and the root is a sudo rule so generous it basically hands you a memory dump…
Proving Grounds: ClamAV
Difficulty: Easy