JOHNYTIGER

LOG · Transmissions

The Log

Notes on web application security, engine and audio tooling, music production, and the platforms behind the label.

HTB: SecNotesLatest

10.28.2026 · Johnytiger

HTB: SecNotes

SecNotes kicks off with a notes web app on port 80 and a CSRF flaw in its password-change page, which we abuse through the contact form to take over tyler's account. His notes leak SMB creds for a writable share, so we drop a PHP webshell, catch a shell and grab the user flag. For root the real trick is a Windows Linux subsystem (WSL) whose bash history is sitting on administrator credentials, so we psexec in and own the box.

securityctfwriteuphackthebox
HTB: ServMon

10.26.2026

HTB: ServMon

ServMon starts with anonymous FTP and an LFI in the NVMS-1000 app on port 80. We read a passwords file off Nathan's desktop through the LFI, spray the creds over SSH and log in as Nadine for the user flag. NSClient++ is listening on 8443 behind the firewall, so we tunnel in over SSH, pull the admin password from the config, upload a script through the REST API and execute it to land a SYSTEM shell and grab root.

securityctfwriteup
HTB: Delegate

10.24.2026

HTB: Delegate

A guest SMB share leaks a SYSVOL logon script with admin creds, and a spray lands A.Briggs. From there we abuse write access to targeted-Kerberoast N.Thompson, whose SeEnableDelegationPrivilege lets us stand up a trusted-for-delegation computer, coerce the DC with PetitPotam, and DCSync the domain admin hash straight to root.

securityctfwriteup
HTB: PC

10.23.2026

HTB: PC

An exposed gRPC service on PC lets us register, grab a token, and SQL-inject the SimpleApp getInfo call to dump SQLite creds straight out of the database. Those log us in over SSH, and an outdated pyLoad (Cheroot) with an unauthenticated RCE lets us flip bash to SUID and walk straight to root.

securityctfwriteup
HTB: Jobs

10.21.2026

HTB: Jobs

A careers site that takes developer applications by email lets us phish the box with a macro-enabled document, landing a shell as jack.black. The hMailServer config leaks admin hashes, and since we can publish to the site as a developer we drop an aspx webshell and ride GodPotato from wwwroot to SYSTEM.

securityctfwriteup
HTB: Management

10.20.2026

HTB: Management

An anonymous LDAP bind and an OpenAM foothold kick this one off, then it's a long grind through OpenAM keystore secrets, a GLPI database, and an encryption key we abuse to finally recover owen's password. From there a NOPASSWD rdiff-backup lets us restore root's files and read the flag.

securityctfwriteup
HTB: Sendai

10.18.2026

HTB: Sendai

A guest-readable share and a pending password-reset policy let us reset two accounts and get a real foothold. From there it's Kerberoasting, a BloodHound path to ReadGMSAPassword on a gMSA account, a dead-end SQL detour, then reversing a service dll into a command injection and GodPotato for SYSTEM.

securityctfwriteup
HTB: Breach

10.16.2026

HTB: Breach

A guest-readable SMB share lets us drop a malicious url file and poison an NTLM hash out of julia.wong, which cracks to a foothold. Kerberoasting hands over the MSSQL service account, and with its NT hash we forge a silver ticket as the Administrator, flip on xp_cmdshell, and ride GodPotato straight to SYSTEM.

securityctfwriteup
HTB: RetroTwo

10.15.2026

HTB: RetroTwo

An encrypted Access database sitting on an open guest share hides the domain credentials, but it takes a custom Java decryptor to pry it open. A foothold as ldapreader leads to a machine account still using its own name as its password, an RDP session onto an ancient Windows Server 2008, and a Perfusion service exploit that finally lands SYSTEM.

securityctfwriteup
HTB: VulnCicada

10.13.2026

HTB: VulnCicada

NFS hands over a list of domain usernames, and a password hiding on a sticky note inside a stego'd PNG gets us our first Kerberos login. From there AD CS is vulnerable to ESC8, but the relay only fires once we feed Active Directory a marshalled DNS record that points the coercion right back at us, ending in a DCSync for Domain Admin.

securityctfwriteup
HTB: Multimaster

10.07.2026

HTB: Multimaster

A full-width apostrophe walks straight past the filter and opens a SQL injection. The app’s own user table is a decoy, so the real domain accounts get resolved through the injection itself, and root comes from a code editor left listening with its debugger open.

securityctfwriteup
HTB: Sizzle

10.07.2026

HTB: Sizzle

Two writable folders on an anonymous share are enough to coerce a domain user into authenticating to Responder. The certificate authority then issues a login certificate, and because Kerberos is firewalled off, the kerberoast has to happen from inside the box.

securityctfwriteup
HTB: Granny

10.07.2026

HTB: Granny

A Windows Server 2003 box running IIS 6 with WebDAV write methods left enabled. The upload filter checks the extension rather than the file, so you upload as text and rename it into something the server will execute, then take SYSTEM with a token impersonation tool from the same era.

securityctfwriteup
HTB: Baby

10.02.2026

HTB: Baby

An anonymous LDAP bind hands over the user list, and one account has its initial password typed into the description field. A disabled account missed by the summary turns into a shell, and the backup privilege turns that shell into the whole directory.

securityctfwriteup
HTB: Bounty

10.01.2026

HTB: Bounty

One open port and a picture of a wizard. An upload page that rejects everything except a web config, which IIS will happily execute, and the impersonate privilege on the service account turns that foothold into SYSTEM.

securityctfwriteup
HTB: Swagshop

09.30.2026

HTB: Swagshop

An unpatched Magento 1.9 storefront. A blind injection writes us our own admin account, an authenticated exploit turns those credentials into code execution, and sudo rights on vi hand over root through a shell escape.

securityctfwriteup
HTB: Usage

09.28.2026

HTB: Usage

A time-based blind injection on a forgotten-password form gives up the admin hash one character at a time. An avatar upload checks the filename rather than the file, a monitoring config leaks a password in plaintext, and a 7-Zip argument quirk prints the root SSH key.

securityctfwriteup
HTB: Dog

09.27.2026

HTB: Dog

A .git directory left exposed at the web root hands over the whole site, including the database password. The admin reused it on their own account, the CMS module installer runs whatever archive you point it at, and a sudo-able command line tool finishes it as root.

securityctfwriteup
HTB: Search

09.26.2026

HTB: Search

A password left legible in a stock photo on the company website opens the door. Kerberoasting gives up a service account, LDAP descriptions expose the HelpDesk temp password, and a machine account plus a careless certificate authority turns into Domain Admin.

securityctfwriteup
HTB: Blackfield

09.23.2026

HTB: Blackfield

A guest-readable profiles share hands over hundreds of usernames, one of which AS-REP roasts. Account Operators lets us reset an auditor’s password, the forensic share holds an lsass dump from a previous breach, and the restore privilege finishes it as SYSTEM.

securityctfwriteup
HTB: Fuse

09.20.2026

HTB: Fuse

A PaperCut print log leaks the staff list and a document name that doubles as the corporate password. Every account demands a password change, a printer description hides a service credential in plaintext, and the load driver privilege finishes it through a vulnerable signed driver.

securityctfwriteup
HTB: Lightweight

09.19.2026

HTB: Lightweight

The site hands you an SSH account named after your own IP. tcpdump has the capabilities to sniff loopback without root, so the site’s own LDAP bind gives up a password in cleartext, and a copy of openssl carrying the setuid capability loads a shared object straight into a root shell.

securityctfwriteup
HT

09.19.2026

HTB: Scrambled

NTLM is switched off across the domain, so everything runs over Kerberos. A username sprayed as its own password opens the door, a kerberoasted SQL service account gets cracked, and a forged silver ticket walks straight past the login the admins thought they had locked down.

securityctfwriteup
HTB: Resolute

09.19.2026

HTB: Resolute

A password left sitting in an Active Directory account description opens the first door. A forgotten PowerShell transcript on disk hands over a second account, and DnsAdmins membership turns a DLL into a SYSTEM shell.

securityctfwriteup
HTB: Intelligence

09.18.2026

HTB: Intelligence

PDF metadata builds the user list and a forgotten onboarding guide supplies the default password. From there a scheduled script that resolves every web DNS record gets coerced into authenticating to Responder, and a group managed service account finishes it through constrained delegation.

securityctfwriteup
HTB: Monteverde

09.17.2026

HTB: Monteverde

Spraying every username as its own password lands a service account. That account can read an azure.xml holding a second password, and membership of Azure Admins means the local ADSync database will hand over the domain administrator credential in plaintext.

securityctfwriteup
HTB: Nest

09.16.2026

HTB: Nest

A guest SMB session, an HR welcome email handing out a temp password, a VB.NET config whose decryption key ships in the source next to it, a password hidden in an alternate data stream, and a debug console that gives up the Administrator credential.

securityctfwriteup
HTB: Sauna

09.16.2026

HTB: Sauna

The bank’s Meet The Team page is the user list. Permuting those names finds an account with Kerberos preauth disabled, an autologon password sits in the registry, and the service account behind it quietly holds DCSync.

securityctfwriteup
HTB: Active

09.15.2026

HTB: Active

A null session reads the Replication share, and Group Policy Preferences hands over a service account password Microsoft published the decryption key for. That account kerberoasts the Administrator SPN and the domain controller falls.

securityctfwriteup
HTB: Forest

09.14.2026

HTB: Forest

A domain controller with no preauth on a service account. AS-REP roasting gives up svc-alfresco, Account Operators lets us mint an account into Exchange Windows Permissions, and WriteDacl on the domain turns into DCSync.

securityctfwriteup
VulnNet: Active

09.08.2026

VulnNet: Active

A Windows domain controller running Redis 2.8 with no auth. A Lua dofile() call coerces the box to authenticate to Responder, the cracked hash opens a writable share, and a swapped scheduled script leads to SYSTEM.

securityctfwriteup
Obscure

09.07.2026

Obscure

A TryHackMe box that runs on patience: anonymous FTP hands over a password-recovery binary, Ghidra hands over its hardcoded ID, an Odoo 10 RCE gets a shell in a container, and a ret2libc ROP chain over pwntools finishes it as root.

securityctfwriteup
MartiniAD

09.06.2026

MartiniAD

A hacksmarter.org Active Directory box: guest access on an SMB share leaks manager credentials, kerberoasting gets a service account, and password reuse turns into DCSync and the krbtgt hash.

securityactive directoryctf
WE

01.01.2026

Welcome to the Blog

A new home for notes on security research, music production, and building things from one studio.

announcements
Drive
Johnytiger