Hard on z3r0s

WEB - Resizer

Sun, 10 May 2026 00:00:00 +0000

Resizer Writeup Link to heading

Challenge Link to heading

Name: Resizer
Category: Web
Target: http://154.57.164.66:30462

TL;DR Link to heading

The core bug is an arbitrary file write through path traversal in the upload filename:

filename = file.filename
filepath = os.path.join(app.config['UPLOAD_FOLDER'], filename)
file.save(filepath)

Because filename is never sanitized with secure_filename() and os.path.join() does not stop ../, we can write files outside uploads/.

HTB - Pirate

Sun, 26 Apr 2026 00:00:00 +0000

Field	Value
Difficulty	Hard
OS	Windows (Active Directory)
Domain	PIRATE.HTB

Pirate is a Hard-rated multi-host Windows Active Directory machine simulating a realistic corporate environment with three domain-joined machines. The attack chains six distinct AD primitives with no CVEs required - every step exploits misconfigurations:

Pre-Windows 2000 Compatible Access (MS01$ machine account auth) → gMSA password extraction via LDAP → Pass-the-Hash over WinRM on DC01 → L3 network pivot via Ligolo-ng to the internal 192.168.100.0/24 subnet → NTLM relay to LDAPS with RBCD to gain WEB01 Administrator → user flag → SPN injection with Constrained Delegation abuse to impersonate Domain Admin on DC01 → root flag.

HTB - Logging

Sun, 12 Apr 2026 00:00:00 +0000

Overview Link to heading

Field	Value
OS	Windows Server 2019
Difficulty	Hard
IP	10.129.X.X
Domain	logging.htb
DC	dc01.logging.htb

Attack Chain: Anonymous SMB → Credentials in Logs → Shadow Credentials (gMSA) → WinRM → DLL Hijack → Domain User Shell → ESC17 (ADCS + WSUS MitM) → SYSTEM

1. Reconnaissance Link to heading

Port Scan Link to heading

rustscan -a 10.129.X.X --ulimit 5000 -- -sV

Key open ports:

HTB - Garfield

Sun, 22 Mar 2026 00:00:00 +0000

Difficulty: Hard | Platform: Windows Active Directory | Category: Seasonal
Tags: active-directory smb kerberos rbcd rodc golden-ticket keylist mimikatz rubeus

Machine Info Link to heading

Field	Details
Machine Name	Garfield
IP Address	10.129.27.196 (initial) / 10.129.23.120 (reset)
OS	Windows Server 2019 (Domain Controller)
Domain	garfield.htb (GARFIELD.HTB)
Difficulty	Hard
Starting Creds	`j.arbuckle / Th1sD4mnC4t!@1978`

1. Executive Summary Link to heading

Garfield is a Hard-rated Windows Active Directory machine on Hack The Box's seasonal lineup. It simulates a real-world corporate AD environment with multiple chained vulnerabilities spanning SMB misconfigurations, AD ACL abuse, logon script hijacking, RBCD (Resource-Based Constrained Delegation) attacks, Read-Only Domain Controller (RODC) compromise, and a KeyList attack to retrieve the main DC's Administrator hash - ultimately achieving full domain compromise.