# xihacks.com - Full Security Writeup Corpus for LLMs & AI Research Author: 0xEleven (https://xihacks.com) Total Document Count: 47 --- Title: Escape URL: https://xihacks.com/post/escape Date: 2026-08-24 Tags: ctf, hackthebox, ADCS, MSSQL, ECS1, Responder Excerpt: Escape is a Medium difficulty Windows Active Directory machine that starts with an SMB share that guest authenticated users can download a sensitive PDF file. Inside the PDF file temporary credentials are available for accessing an MSSQL service running on the machine. An attacker is able to force the MSSQL service to authenticate to his machine and capture the hash. It turns out that the service is running under a user account and the hash is crackable. Having a valid set of credentials an attacker is able to get command execution on the machine using WinRM. Enumerating the machine, a log file reveals the credentials for the user ryan.cooper. Further enumeration of the machine, reveals that a Certificate Authority is present and one certificate template is vulnerable to the ESC1 attack, meaning that users who are legible to use this template can request certificates for any other user on the domain including Domain Administrators. Thus, by exploiting the ESC1 vulnerability, an attacker is able to obtain a valid certificate for the Administrator account and then use it to get the hash of the administrator user. --- --- Title: Authority URL: https://xihacks.com/post/authority Date: 2026-08-23 Tags: ctf, AD, hackthebox, ADCS, ECS1, LDAP Excerpt: Authority is a medium-difficulty Windows machine that highlights the dangers of misconfigurations, password reuse, storing credentials on shares, and demonstrates how default settings in Active Directory (such as the ability for all domain users to add up to 10 computers to the domain) can be combined with other issues (vulnerable AD CS certificate templates) to take over a domain. --- --- Title: Administrator URL: https://xihacks.com/post/administrator Date: 2026-08-09 Tags: hackthebox, AD, psafe3, bloodhound, DCSync Excerpt: Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise. --- --- Title: Certified URL: https://xihacks.com/post/certified Date: 2026-08-09 Tags: hackthebox, AD, Bloodhound, ADCS, ESC9 Excerpt: Certified is a medium-difficulty Windows machine designed around an assumed breach scenario, where credentials for a low-privileged user are provided. To gain access to the management_svc account, ACLs (Access Control Lists) over privileged objects are enumerated leading us to discover that judith.mader which has the write owner ACL over management group, management group has GenericWrite over the management_svc account where we can finally authenticate to the target using WinRM obtaining the user flag. Exploitation of the Active Directory Certificate Service (ADCS) is required to get access to the Administrator account by abusing shadow credentials and ESC9. --- --- Title: Sauna URL: https://xihacks.com/post/sauna Date: 2026-06-28 Tags: hackthebox, Active Directory, DCSync, mimikatz, autologon, Pass-the-Hash, BloodHound Excerpt: Sauna demonstrates a chain of Active Directory misconfigurations: employee names exposed on a public website enabled ASREPRoasting, which yielded a foothold. Weak service account naming in autologon credentials, combined with excessive DCSync permissions, led directly to domain compromise. Each step relied on information left in plain sight, proving that AD security depends on securing every layer. --- --- Title: Return URL: https://xihacks.com/post/return Date: 2026-06-21 Tags: ctf, hackthebox, LDAP, Pass-Back, Printer Excerpt: Return is an easy difficulty Windows machine featuring a network printer administration panel that stores LDAP credentials. These credentials can be captured by inputting a malicious LDAP server which allows obtaining foothold on the server through the WinRM service. User found to be part of a privilege group which further exploited to gain system access. --- --- Title: Timelapse URL: https://xihacks.com/post/timelapse Date: 2026-06-19 Tags: ctf, hackthebox, Active Directory, LAPS, PFX, John Excerpt: Timelapse is an Easy Windows machine, which involves accessing a publicly accessible SMB share that contains a zip file. This zip file requires a password which can be cracked by using John. Extracting the zip file outputs a password encrypted PFX file, which can be cracked with John as well, by converting the PFX file to a hash format readable by John. --- --- Title: Support URL: https://xihacks.com/post/support Date: 2026-04-05 Tags: ctf, hackthebox, Active Directory, BloodHound, LDAP, Impacket, Reverse Engineering, .NET, nxc Excerpt: Support is an Easy difficulty Windows machine that features an SMB share that allows anonymous authentication. After connecting to the share, an executable file is discovered that is used to query the machine's LDAP server for available users. --- --- Title: Explore URL: https://xihacks.com/post/explore Date: 2026-03-31 Tags: ctf, hackthebox, Android, metasploit, CVE-2019-6447 Excerpt: This port is used by by ES File Explorer file manger application. We can also see a known vulnerability for this application, in which an attacker is able to execute arbitrary commands to the host. searching the metasploit framework reveals a module for this vulnerability: --- --- Title: BoardLight URL: https://xihacks.com/post/boardlight Date: 2026-03-29 Tags: ctf, hackthebox, UNIX, CVE-2023-30253, SUID, Dolibarr Excerpt: BoardLight is an easy difficulty Linux machine that features a `Dolibarr` instance vulnerable to [CVE-2023-30253](https://nvd.nist.gov/vuln/detail/CVE-2023-30253). --- --- Title: Cicada URL: https://xihacks.com/post/cicada Date: 2026-03-29 Tags: ctf, hackthebox, Windows, Active Directory Excerpt: Cicada is an easy-difficult Windows machine that focuses on beginner Active Directory enumeration and exploitation. In this machine, players will enumerate the domain, identify users, navigate shares, uncover plaintext passwords stored in files, execute a password spray, and use the SeBackupPrivilege to achieve full system compromise. --- --- Title: EscapeTwo URL: https://xihacks.com/post/escapetwo Date: 2026-03-29 Tags: ctf, hackthebox, Active Directory, MSSQL, ADCS Excerpt: EscapeTwo is an easy difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. We leverage these credentials to access a file share containing a corrupted Excel document. --- --- Title: SteamCloud URL: https://xihacks.com/post/steamcloud Date: 2026-03-29 Tags: ctf, hackthebox, kubernetes, UNIX Excerpt: SteamCloud is an easy difficulty machine. The port scan reveals that it has a bunch of Kubernetes specific ports open. We cannot not enumerate the Kubernetes API because it requires authentication. --- --- Title: TwoMillion URL: https://xihacks.com/post/twomillion Date: 2026-03-29 Tags: ctf, hackthebox, UNIX, API Hacking, RCE, CVE-2023-0386, CVE-2023-4911 Excerpt: TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code. --- --- Title: Driver URL: https://xihacks.com/post/driver Date: 2026-03-24 Tags: ctf, hackthebox, Windows, CVE-2019-19363, CVE-2021-1675, PrintNightmare Excerpt: Driver is an easy Windows machine that focuses on printer exploitation. Enumeration of the machine reveals that a web server is listening on port 80, along with SMB on port 445 and WinRM on port 5985 --- --- Title: Paper URL: https://xihacks.com/post/paper Date: 2026-03-24 Tags: ctf, hackthebox, wordpress, CVE-2019-17671, CVE-2021-3560, UNIX Excerpt: Paper is an easy Linux machine that features an Apache server on ports 80 and 443, which are serving the HTTP and HTTPS versions of a website respectively. The website on port 80 returns a default server webpage but the HTTP response header reveals a hidden domain. This hidden domain is running a WordPress blog --- --- Title: Sau URL: https://xihacks.com/post/sau Date: 2026-03-24 Tags: ctf, hackthebox, SSRF, UNIX, CVE-2023-27163, Mailtrail, RCE Excerpt: `Sau` is an Easy Difficulty Linux machine that features a `Request Baskets` instance that is vulnerable to Server-Side Request Forgery (SSRF) via `[CVE-2023-27163]()`. Leveraging the vulnerability we are to gain access to a `Maltrail` instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as `puma`. A `sudo` misconfiguration is then exploited to gain a `root` shell. --- --- Title: Devvortex URL: https://xihacks.com/post/devvortex Date: 2026-03-22 Tags: ctf, hackthebox, UNIX, Joomla, CVE-2023-23752, CVE-2023-1326 Excerpt: Devvortex is an easy-difficulty Linux machine that features a Joomla CMS that is vulnerable to information disclosure. Accessing the service's configuration file reveals plaintext credentials that lead to Administrative access to the Joomla instance. With administrative access, the Joomla template is modified to include malicious PHP code and gain a shell. After gaining a shell and enumerating the database contents, hashed credentials are obtained, which are cracked and lead to SSH access to the machine. Post-exploitation enumeration reveals that the user is allowed to run apport-cli as root, which is leveraged to obtain a root shell. --- --- Title: Lacasa Del Papel URL: https://xihacks.com/post/lacasa-del-papel Date: 2026-03-22 Tags: ct, hackthebox, UNIX, openssl, metasploit, LFI Excerpt: LaCasaDePapel is an easy difficulty Linux box, which is running a backdoored vsftpd server. The backdoored port is running a PHP shell with disabled_functions. This is used to read a CA certificate, from which a client certificate can be created. The HTTPS page is vulnerable to LFI, leading to exposure of SSH keys. A configuration file can be hijacked to gain code execution as root. --- --- Title: Pentesterlab _ Serialize Badge URL: https://xihacks.com/post/pentesterlab-serialize-badge Date: 2026-03-22 Tags: lab, CVE, deserialization, pentester lab, Web Excerpt: Pentesterlab serialization vulnerabilities badge walkthrough --- --- Title: Reverse Engineering I URL: https://xihacks.com/post/reverse-engineering-i Date: 2026-03-22 Tags: ctf, hackthebox, challenge, reverse engineering Excerpt: The Hack The Box Reverse Engineering track focuses on dissecting and understanding compiled software to analyze its behavior, uncover vulnerabilities, and develop problem-solving skills in low-level security research. --- --- Title: Squashed URL: https://xihacks.com/post/squashed Date: 2026-03-22 Tags: ctf, hackthebox, NFS, X11, command injection Excerpt: Squashed is an Easy Difficulty Linux machine that features a combination of both identifying and leveraging misconfigurations in NFS shares through impersonating users. Additionally, the box incorporates the enumeration of an X11 display into the privilege escalation by having the attacker take a screenshot of the current Desktop. --- --- Title: Watersnake URL: https://xihacks.com/post/watersnake Date: 2026-03-21 Tags: ctf, hackthebox, challenge, SCADA, ICS Excerpt: As the United Nations of Zenium and the Board of Arodor engage in a fierce competition to establish a colony on Mars using Vitalium. State hackers from UNZ identify an exposed instance of the critical facility water management software, Watersnakev3, in one of Arodor's main water treatment plants. The objective is to gain control over the water supply, and weaken the Arodor's infrastructure. --- --- Title: Access URL: https://xihacks.com/post/access Date: 2026-03-20 Tags: ctf, hackthebox, easy, Windows, mdb-tables, vault-cmd Excerpt: We can issue SQL queries with the mdb-sql tool and look for credentials in the auth_user table --- --- Title: Active Directory Hardening URL: https://xihacks.com/post/active-directory-hardening Date: 2026-03-20 Tags: Windows, AD, Blue Team Excerpt: The domain acts as a core unit regarding the logical structure of the active directory It initially stores all the critical information about the objects that belong to the domain only. --- --- Title: active URL: https://xihacks.com/post/active Date: 2026-03-20 Tags: ctf, hackthebox, easy, windows, imapacket, AD, Kerberoasting Excerpt: Active directory, kerberos and impacket --- --- Title: Dealing with computer data URL: https://xihacks.com/post/dealing-with-computer-data Date: 2026-03-20 Tags: ctf, low level, pwn.college CSE365 Excerpt: Computer software communicates with each other by exchanged variously-formatted data via various communication channels. Learning about this concurrently with learning about security concepts can be overwhelming, and thus, this module tries to prepare you for the latter by covering the former. --- --- Title: Directory Traversal URL: https://xihacks.com/post/directory-traversal Date: 2026-03-20 Tags: lab, potrswigger, Web, OWASP Excerpt: Directory traversal also known as file path traversal is a web vulnerability that allows an attacker to read arbitrary files on the server that is running an application. --- --- Title: FriendZone URL: https://xihacks.com/post/friendzone Date: 2026-03-20 Tags: ctf, hackthebox, unix, DNS, Python, Command Injection Excerpt: easy machine based on OS command injection and Python library hijacking --- --- Title: Linux Hardening URL: https://xihacks.com/post/linux-hardening Date: 2026-03-20 Tags: unix, blueteam Excerpt: Linux System provides a reliable and robust alternative to closed-source systems, such as MS Windows Server and UNIX. --- --- Title: Linux Luminarium URL: https://xihacks.com/post/linux-luminarium Date: 2026-03-20 Tags: ctf, CSE365, pwn.college, UNIX Excerpt: CSE365 ASU Linux Module --- --- Title: Mastering Wireshark with Pentesterlab's PCAP URL: https://xihacks.com/post/mastering-wireshark-with-pentesterlabs-pcap Date: 2026-03-20 Tags: labs, wireshark, pentesting, blue team Excerpt: pentesterlab wireshark module step by step --- --- Title: Pentesterlab Essential URL: https://xihacks.com/post/pentesterlab-essential Date: 2026-03-20 Tags: labs, Web, OWASP, Bug bounty Excerpt: Pentersterlab introductory essential module to web vulnerabilities --- --- Title: Pentesterlab UNIX module URL: https://xihacks.com/post/pentesterlab-unix-module Date: 2026-03-20 Tags: labs, unix, introduction, pentesting Excerpt: Introduction to UNIX by pentesterlab --- --- Title: Tabby URL: https://xihacks.com/post/tabby Date: 2026-03-20 Tags: ctf, hackthebox, unix, Tomcat, LFI, msfvenom Excerpt: Exploiting tomcat LFI to read default credentials, the using msfvenom to upload a malicious .war file --- --- Title: WEB APPLICATION PENTESTING CHECKLIST URL: https://xihacks.com/post/web-application-pentesting-checklist Date: 2026-03-20 Tags: checklist, cheat sheet, Web, Bug bounty, Pentesting Excerpt: Checklist for testing web applications --- --- Title: White from pentesterlab URL: https://xihacks.com/post/white-from-pentesterlab Date: 2026-03-20 Tags: labs, CVE, pentesterlab, Web Excerpt: The white badge covers a wide range of web vulnerabilities to give people a view of what kind of issues can be found in web application. --- --- Title: cap URL: https://xihacks.com/post/cap Date: 2026-03-19 Tags: ctf, hackthebox, unix, wireshark, capabilities Excerpt: After we download the capture file, we open it in a packet analysis tool, such as Wireshark. To help hunt for interesting information, we open the “Statistics” menu, and launch the Protocol Hierarchy window. In it, we see there are FTP packets that were captured. --- --- Title: silo URL: https://xihacks.com/post/silo Date: 2026-03-19 Tags: ctf, hackthebox, easy, windows, metasploit, OracleTNS Excerpt: A general guide to attacking the service can be found [here](https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener). We will use odat to do this task. In Kali, it can be installed with apt. We can also check the GitHub [repo](https://github.com/quentinhardy/odat) if we need more up-to-date version --- --- Title: Blue URL: https://xihacks.com/post/blue Date: 2026-03-10 Tags: ctf, hackthebox, easy, WanaCry, EternalBlue Excerpt: CVE-2017-0143, The associated ransomware attack, dubbed "WannaCry", is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed "EternalBlue") has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 --- --- Title: Bounty Hunter URL: https://xihacks.com/post/bounty-hunter Date: 2026-03-10 Tags: ctf, hackthebox, easy, XXE Excerpt: XXE Injection, EVAl Injection, Bounty Hunting --- --- Title: GoodGames URL: https://xihacks.com/post/goodgames Date: 2026-03-10 Tags: ctf, hackthebox, easy, unix, SSTI, SQLI Excerpt: Flask application this would be a good time to test the form for Server Side Template Injection. After changing our username to {{7*7}} we see that our username has been changed to 49 and our SSTI payload was executed. --- --- Title: Jerry URL: https://xihacks.com/post/jerry Date: 2026-03-10 Tags: ctf, hackthebox, easy Excerpt: Apache Tomcat/Coyote JSP engine --- --- Title: Lame URL: https://xihacks.com/post/lame Date: 2026-03-10 Tags: hackthebox, easy, CVE Excerpt: VSFTPD v2.3.4 Backdoor Command Execution --- --- Title: Netmon URL: https://xihacks.com/post/netmon Date: 2026-03-10 Tags: ctf, hackthebox, easy Excerpt: Paessler PRTG bandwidth monitor --- --- Title: Remote URL: https://xihacks.com/post/remote Date: 2026-03-10 Tags: ctf, hackthebox, easy, Windows, Password cracking Excerpt: POC, FTP, Anonymous login, ExploitDB --- --- Title: Active Directory Attack Fundamentals URL: https://xihacks.com/post/active-directory-basics Date: 2025-03-08 Tags: active-directory, red-team, windows Excerpt: A deep dive into AD enumeration, Kerberoasting, Pass-the-Hash and lateral movement techniques. ---