Easy on z3r0s

HTB - WingData

Fri, 08 May 2026 00:00:00 +0000

Field	Value
Difficulty	Easy
OS	Linux
CVEs	CVE-2025-47812 · CVE-2025-4517 · CVE-2025-4138

Summary Link to heading

WingData is an Easy Linux machine. A company website redirects to an FTP client portal running Wing FTP Server v7.4.3, which is vulnerable to an unauthenticated RCE (CVE-2025-47812). Post-exploitation enumeration reveals a salted SHA-256 hash for user wacky stored in Wing FTP config files. After cracking the hash with hashcat and gaining SSH access, a misconfigured sudo rule allows execution of a Python backup restoration script as root. The script is vulnerable to CVE-2025-4517, a tarfile PATH_MAX bypass that allows arbitrary file write - used to overwrite /etc/sudoers and gain root.

HTB - Kobold

Sun, 05 Apr 2026 00:00:00 +0000

Field	Value
Difficulty	Easy
OS	Linux (Ubuntu)
CVE	CVE-2026-23744
Tags	`docker` `gshadow` `lfi` `mcp` `mcpjam` `pastebin` `path-traversal` `rce`

Summary Link to heading

Kobold is a Linux easy box featuring a multi-service web application behind nginx with HTTPS and wildcard virtual hosting. Initial access requires exploiting CVE-2026-23744 - an unauthenticated RCE in MCPJam Inspector - by sending a crafted JSON payload to /api/mcp/connect to execute arbitrary commands. Privilege escalation abuses a discrepancy between /etc/gshadow and the running session, allowing the sg command to switch into the docker group and mount the host filesystem inside a container.

HTB - Facts

Sun, 15 Mar 2026 00:00:00 +0000

Field	Value
Difficulty	Easy
OS	Linux
Techniques	Mass Assignment · MinIO · ssh2john · facter GTFOBin

Summary Link to heading

Facts is an Easy Linux machine running a Ruby on Rails CMS. The intended foothold is a Mass Assignment vulnerability in the password change endpoint - by appending &password[role]=admin to the intercepted request, a low-privilege user escalates to admin without touching the LFI path. As admin, MinIO S3 credentials are exposed in the General Site filesystem settings. Using the mc client, an SSH private key is pulled from the internal MinIO bucket. The key passphrase is cracked offline with ssh2john + john (rockyou.txt → dragonballz). SSH access lands as trivia, who can run /usr/bin/facter as root via sudo. A malicious Ruby script planted in /tmp/piv and loaded via --custom-dir gives a root shell.

HTB - CCTV

Sun, 01 Mar 2026 00:00:00 +0000

Field	Value
Difficulty	Easy
OS	Linux (Ubuntu 24.04)
CVE	CVE-2024-51482

Summary Link to heading

CCTV is an Easy Linux machine running ZoneMinder, a CCTV management web application. The attack chain involves exploiting a boolean-based SQL injection vulnerability (CVE-2024-51482) to enumerate the database and dump credentials, then pivoting through an internal Motion/MotionEye camera stack via command injection in the picture_filename parameter to gain a root shell.