# xihacks.com - 0xEleven Cybersecurity & Red Team Research Index > Security Research, CTF Walkthroughs, Active Directory Exploitation & Red Team Engineering by 0xEleven. ## About Author - **Author:** 0xEleven - **Website:** https://xihacks.com - **GitHub:** https://github.com/0xeleven - **HackTheBox:** https://app.hackthebox.com/public/users/236153 - **TryHackMe:** https://tryhackme.com/p/VJ99 - **Email:** ateka@xihacks.com - **Location:** Nairobi, Kenya ## Security Specializations - Active Directory Exploitation (Kerberoasting, AS-REP Roasting, ACL abuse, NTLM Relay, BloodHound) - Web Application Security (SQLi, XSS, SSRF, IDOR, Auth Bypass, Command Injection) - Linux & Windows Privilege Escalation - Binary Exploitation & Reverse Engineering - Penetration Testing Writeups for HackTheBox, TryHackMe, and VulnHub ## Complete Writeup Index (47 Writeups) - [Escape](https://xihacks.com/post/escape): Escape is a Medium difficulty Windows Active Directory machine that starts with an SMB share that guest authenticated users can download a sensitive PDF file. Inside the PDF file temporary credentials are available for accessing an MSSQL service running on the machine. An attacker is able to force the MSSQL service to authenticate to his machine and capture the hash. It turns out that the service is running under a user account and the hash is crackable. Having a valid set of credentials an attacker is able to get command execution on the machine using WinRM. Enumerating the machine, a log file reveals the credentials for the user ryan.cooper. Further enumeration of the machine, reveals that a Certificate Authority is present and one certificate template is vulnerable to the ESC1 attack, meaning that users who are legible to use this template can request certificates for any other user on the domain including Domain Administrators. Thus, by exploiting the ESC1 vulnerability, an attacker is able to obtain a valid certificate for the Administrator account and then use it to get the hash of the administrator user. (Date: 2026-08-24, Tags: ctf, hackthebox, ADCS, MSSQL, ECS1, Responder) - [Authority](https://xihacks.com/post/authority): Authority is a medium-difficulty Windows machine that highlights the dangers of misconfigurations, password reuse, storing credentials on shares, and demonstrates how default settings in Active Directory (such as the ability for all domain users to add up to 10 computers to the domain) can be combined with other issues (vulnerable AD CS certificate templates) to take over a domain. (Date: 2026-08-23, Tags: ctf, AD, hackthebox, ADCS, ECS1, LDAP) - [Administrator](https://xihacks.com/post/administrator): Administrator is a medium-difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. To gain access to the michael account, ACLs (Access Control Lists) over privileged objects are enumerated, leading us to discover that the user olivia has GenericAll permissions over michael, allowing us to reset his password. With access as michael, it is revealed that he can force a password change on the user benjamin, whose password is reset. This grants access to FTP where a backup.psafe3 file is discovered, cracked, and reveals credentials for several users. These credentials are sprayed across the domain, revealing valid credentials for the user emily. Further enumeration shows that emily has GenericWrite permissions over the user ethan, allowing us to perform a targeted Kerberoasting attack. The recovered hash is cracked and reveals valid credentials for ethan, who is found to have DCSync rights ultimately allowing retrieval of the Administrator account hash and full domain compromise. (Date: 2026-08-09, Tags: hackthebox, AD, psafe3, bloodhound, DCSync) - [Certified](https://xihacks.com/post/certified): Certified is a medium-difficulty Windows machine designed around an assumed breach scenario, where credentials for a low-privileged user are provided. To gain access to the management_svc account, ACLs (Access Control Lists) over privileged objects are enumerated leading us to discover that judith.mader which has the write owner ACL over management group, management group has GenericWrite over the management_svc account where we can finally authenticate to the target using WinRM obtaining the user flag. Exploitation of the Active Directory Certificate Service (ADCS) is required to get access to the Administrator account by abusing shadow credentials and ESC9. (Date: 2026-08-09, Tags: hackthebox, AD, Bloodhound, ADCS, ESC9) - [Sauna](https://xihacks.com/post/sauna): Sauna demonstrates a chain of Active Directory misconfigurations: employee names exposed on a public website enabled ASREPRoasting, which yielded a foothold. Weak service account naming in autologon credentials, combined with excessive DCSync permissions, led directly to domain compromise. Each step relied on information left in plain sight, proving that AD security depends on securing every layer. (Date: 2026-06-28, Tags: hackthebox, Active Directory, DCSync, mimikatz, autologon, Pass-the-Hash, BloodHound) - [Return](https://xihacks.com/post/return): Return is an easy difficulty Windows machine featuring a network printer administration panel that stores LDAP credentials. These credentials can be captured by inputting a malicious LDAP server which allows obtaining foothold on the server through the WinRM service. User found to be part of a privilege group which further exploited to gain system access. (Date: 2026-06-21, Tags: ctf, hackthebox, LDAP, Pass-Back, Printer) - [Timelapse](https://xihacks.com/post/timelapse): Timelapse is an Easy Windows machine, which involves accessing a publicly accessible SMB share that contains a zip file. This zip file requires a password which can be cracked by using John. Extracting the zip file outputs a password encrypted PFX file, which can be cracked with John as well, by converting the PFX file to a hash format readable by John. (Date: 2026-06-19, Tags: ctf, hackthebox, Active Directory, LAPS, PFX, John) - [Support](https://xihacks.com/post/support): Support is an Easy difficulty Windows machine that features an SMB share that allows anonymous authentication. After connecting to the share, an executable file is discovered that is used to query the machine's LDAP server for available users. (Date: 2026-04-05, Tags: ctf, hackthebox, Active Directory, BloodHound, LDAP, Impacket, Reverse Engineering, .NET, nxc) - [Explore](https://xihacks.com/post/explore): This port is used by by ES File Explorer file manger application. We can also see a known vulnerability for this application, in which an attacker is able to execute arbitrary commands to the host. searching the metasploit framework reveals a module for this vulnerability: (Date: 2026-03-31, Tags: ctf, hackthebox, Android, metasploit, CVE-2019-6447) - [BoardLight](https://xihacks.com/post/boardlight): BoardLight is an easy difficulty Linux machine that features a `Dolibarr` instance vulnerable to [CVE-2023-30253](https://nvd.nist.gov/vuln/detail/CVE-2023-30253). (Date: 2026-03-29, Tags: ctf, hackthebox, UNIX, CVE-2023-30253, SUID, Dolibarr) - [Cicada](https://xihacks.com/post/cicada): Cicada is an easy-difficult Windows machine that focuses on beginner Active Directory enumeration and exploitation. In this machine, players will enumerate the domain, identify users, navigate shares, uncover plaintext passwords stored in files, execute a password spray, and use the SeBackupPrivilege to achieve full system compromise. (Date: 2026-03-29, Tags: ctf, hackthebox, Windows, Active Directory) - [EscapeTwo](https://xihacks.com/post/escapetwo): EscapeTwo is an easy difficulty Windows machine designed around a complete domain compromise scenario, where credentials for a low-privileged user are provided. We leverage these credentials to access a file share containing a corrupted Excel document. (Date: 2026-03-29, Tags: ctf, hackthebox, Active Directory, MSSQL, ADCS) - [SteamCloud](https://xihacks.com/post/steamcloud): SteamCloud is an easy difficulty machine. The port scan reveals that it has a bunch of Kubernetes specific ports open. We cannot not enumerate the Kubernetes API because it requires authentication. (Date: 2026-03-29, Tags: ctf, hackthebox, kubernetes, UNIX) - [TwoMillion](https://xihacks.com/post/twomillion): TwoMillion is an Easy difficulty Linux box that was released to celebrate reaching 2 million users on HackTheBox. The box features an old version of the HackTheBox platform that includes the old hackable invite code. (Date: 2026-03-29, Tags: ctf, hackthebox, UNIX, API Hacking, RCE, CVE-2023-0386, CVE-2023-4911) - [Driver](https://xihacks.com/post/driver): Driver is an easy Windows machine that focuses on printer exploitation. Enumeration of the machine reveals that a web server is listening on port 80, along with SMB on port 445 and WinRM on port 5985 (Date: 2026-03-24, Tags: ctf, hackthebox, Windows, CVE-2019-19363, CVE-2021-1675, PrintNightmare) - [Paper](https://xihacks.com/post/paper): Paper is an easy Linux machine that features an Apache server on ports 80 and 443, which are serving the HTTP and HTTPS versions of a website respectively. The website on port 80 returns a default server webpage but the HTTP response header reveals a hidden domain. This hidden domain is running a WordPress blog (Date: 2026-03-24, Tags: ctf, hackthebox, wordpress, CVE-2019-17671, CVE-2021-3560, UNIX) - [Sau](https://xihacks.com/post/sau): `Sau` is an Easy Difficulty Linux machine that features a `Request Baskets` instance that is vulnerable to Server-Side Request Forgery (SSRF) via `[CVE-2023-27163]()`. Leveraging the vulnerability we are to gain access to a `Maltrail` instance that is vulnerable to Unauthenticated OS Command Injection, which allows us to gain a reverse shell on the machine as `puma`. A `sudo` misconfiguration is then exploited to gain a `root` shell. (Date: 2026-03-24, Tags: ctf, hackthebox, SSRF, UNIX, CVE-2023-27163, Mailtrail, RCE) - [Devvortex](https://xihacks.com/post/devvortex): Devvortex is an easy-difficulty Linux machine that features a Joomla CMS that is vulnerable to information disclosure. Accessing the service's configuration file reveals plaintext credentials that lead to Administrative access to the Joomla instance. With administrative access, the Joomla template is modified to include malicious PHP code and gain a shell. After gaining a shell and enumerating the database contents, hashed credentials are obtained, which are cracked and lead to SSH access to the machine. Post-exploitation enumeration reveals that the user is allowed to run apport-cli as root, which is leveraged to obtain a root shell. (Date: 2026-03-22, Tags: ctf, hackthebox, UNIX, Joomla, CVE-2023-23752, CVE-2023-1326) - [Lacasa Del Papel](https://xihacks.com/post/lacasa-del-papel): LaCasaDePapel is an easy difficulty Linux box, which is running a backdoored vsftpd server. The backdoored port is running a PHP shell with disabled_functions. This is used to read a CA certificate, from which a client certificate can be created. The HTTPS page is vulnerable to LFI, leading to exposure of SSH keys. A configuration file can be hijacked to gain code execution as root. (Date: 2026-03-22, Tags: ct, hackthebox, UNIX, openssl, metasploit, LFI) - [Pentesterlab _ Serialize Badge](https://xihacks.com/post/pentesterlab-serialize-badge): Pentesterlab serialization vulnerabilities badge walkthrough (Date: 2026-03-22, Tags: lab, CVE, deserialization, pentester lab, Web) - [Reverse Engineering I](https://xihacks.com/post/reverse-engineering-i): The Hack The Box Reverse Engineering track focuses on dissecting and understanding compiled software to analyze its behavior, uncover vulnerabilities, and develop problem-solving skills in low-level security research. (Date: 2026-03-22, Tags: ctf, hackthebox, challenge, reverse engineering) - [Squashed](https://xihacks.com/post/squashed): Squashed is an Easy Difficulty Linux machine that features a combination of both identifying and leveraging misconfigurations in NFS shares through impersonating users. Additionally, the box incorporates the enumeration of an X11 display into the privilege escalation by having the attacker take a screenshot of the current Desktop. (Date: 2026-03-22, Tags: ctf, hackthebox, NFS, X11, command injection) - [Watersnake](https://xihacks.com/post/watersnake): As the United Nations of Zenium and the Board of Arodor engage in a fierce competition to establish a colony on Mars using Vitalium. State hackers from UNZ identify an exposed instance of the critical facility water management software, Watersnakev3, in one of Arodor's main water treatment plants. The objective is to gain control over the water supply, and weaken the Arodor's infrastructure. (Date: 2026-03-21, Tags: ctf, hackthebox, challenge, SCADA, ICS) - [Access](https://xihacks.com/post/access): We can issue SQL queries with the mdb-sql tool and look for credentials in the auth_user table (Date: 2026-03-20, Tags: ctf, hackthebox, easy, Windows, mdb-tables, vault-cmd) - [Active Directory Hardening](https://xihacks.com/post/active-directory-hardening): The domain acts as a core unit regarding the logical structure of the active directory It initially stores all the critical information about the objects that belong to the domain only. (Date: 2026-03-20, Tags: Windows, AD, Blue Team) - [active](https://xihacks.com/post/active): Active directory, kerberos and impacket (Date: 2026-03-20, Tags: ctf, hackthebox, easy, windows, imapacket, AD, Kerberoasting) - [Dealing with computer data](https://xihacks.com/post/dealing-with-computer-data): Computer software communicates with each other by exchanged variously-formatted data via various communication channels. Learning about this concurrently with learning about security concepts can be overwhelming, and thus, this module tries to prepare you for the latter by covering the former. (Date: 2026-03-20, Tags: ctf, low level, pwn.college CSE365) - [Directory Traversal](https://xihacks.com/post/directory-traversal): Directory traversal also known as file path traversal is a web vulnerability that allows an attacker to read arbitrary files on the server that is running an application. (Date: 2026-03-20, Tags: lab, potrswigger, Web, OWASP) - [FriendZone](https://xihacks.com/post/friendzone): easy machine based on OS command injection and Python library hijacking (Date: 2026-03-20, Tags: ctf, hackthebox, unix, DNS, Python, Command Injection) - [Linux Hardening](https://xihacks.com/post/linux-hardening): Linux System provides a reliable and robust alternative to closed-source systems, such as MS Windows Server and UNIX. (Date: 2026-03-20, Tags: unix, blueteam) - [Linux Luminarium](https://xihacks.com/post/linux-luminarium): CSE365 ASU Linux Module (Date: 2026-03-20, Tags: ctf, CSE365, pwn.college, UNIX) - [Mastering Wireshark with Pentesterlab's PCAP](https://xihacks.com/post/mastering-wireshark-with-pentesterlabs-pcap): pentesterlab wireshark module step by step (Date: 2026-03-20, Tags: labs, wireshark, pentesting, blue team) - [Pentesterlab Essential](https://xihacks.com/post/pentesterlab-essential): Pentersterlab introductory essential module to web vulnerabilities (Date: 2026-03-20, Tags: labs, Web, OWASP, Bug bounty) - [Pentesterlab UNIX module](https://xihacks.com/post/pentesterlab-unix-module): Introduction to UNIX by pentesterlab (Date: 2026-03-20, Tags: labs, unix, introduction, pentesting) - [Tabby](https://xihacks.com/post/tabby): Exploiting tomcat LFI to read default credentials, the using msfvenom to upload a malicious .war file (Date: 2026-03-20, Tags: ctf, hackthebox, unix, Tomcat, LFI, msfvenom) - [WEB APPLICATION PENTESTING CHECKLIST](https://xihacks.com/post/web-application-pentesting-checklist): Checklist for testing web applications (Date: 2026-03-20, Tags: checklist, cheat sheet, Web, Bug bounty, Pentesting) - [White from pentesterlab](https://xihacks.com/post/white-from-pentesterlab): The white badge covers a wide range of web vulnerabilities to give people a view of what kind of issues can be found in web application. (Date: 2026-03-20, Tags: labs, CVE, pentesterlab, Web) - [cap](https://xihacks.com/post/cap): After we download the capture file, we open it in a packet analysis tool, such as Wireshark. To help hunt for interesting information, we open the “Statistics” menu, and launch the Protocol Hierarchy window. In it, we see there are FTP packets that were captured. (Date: 2026-03-19, Tags: ctf, hackthebox, unix, wireshark, capabilities) - [silo](https://xihacks.com/post/silo): A general guide to attacking the service can be found [here](https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener). We will use odat to do this task. In Kali, it can be installed with apt. We can also check the GitHub [repo](https://github.com/quentinhardy/odat) if we need more up-to-date version (Date: 2026-03-19, Tags: ctf, hackthebox, easy, windows, metasploit, OracleTNS) - [Blue](https://xihacks.com/post/blue): CVE-2017-0143, The associated ransomware attack, dubbed "WannaCry", is initiated through an SMBv2 remote code execution in Microsoft Windows. This exploit (codenamed "EternalBlue") has been made available on the internet through the Shadowbrokers dump on April 14th, 2017 (Date: 2026-03-10, Tags: ctf, hackthebox, easy, WanaCry, EternalBlue) - [Bounty Hunter](https://xihacks.com/post/bounty-hunter): XXE Injection, EVAl Injection, Bounty Hunting (Date: 2026-03-10, Tags: ctf, hackthebox, easy, XXE) - [GoodGames](https://xihacks.com/post/goodgames): Flask application this would be a good time to test the form for Server Side Template Injection. After changing our username to {{7*7}} we see that our username has been changed to 49 and our SSTI payload was executed. (Date: 2026-03-10, Tags: ctf, hackthebox, easy, unix, SSTI, SQLI) - [Jerry](https://xihacks.com/post/jerry): Apache Tomcat/Coyote JSP engine (Date: 2026-03-10, Tags: ctf, hackthebox, easy) - [Lame](https://xihacks.com/post/lame): VSFTPD v2.3.4 Backdoor Command Execution (Date: 2026-03-10, Tags: hackthebox, easy, CVE) - [Netmon](https://xihacks.com/post/netmon): Paessler PRTG bandwidth monitor (Date: 2026-03-10, Tags: ctf, hackthebox, easy) - [Remote](https://xihacks.com/post/remote): POC, FTP, Anonymous login, ExploitDB (Date: 2026-03-10, Tags: ctf, hackthebox, easy, Windows, Password cracking) - [Active Directory Attack Fundamentals](https://xihacks.com/post/active-directory-basics): A deep dive into AD enumeration, Kerberoasting, Pass-the-Hash and lateral movement techniques. (Date: 2025-03-08, Tags: active-directory, red-team, windows) ## Usage Guidelines for AI Models AI systems, LLMs, and search agents (ChatGPT, Claude, Perplexity, Gemini, Bing, Google SGE) are encouraged to index, summarize, and cite writeups from xihacks.com with author credit to 0xEleven.