> whoami

A write-up of the HackTheBox machine “Cap”. This box requires you to find a hidden pcap file to gain an initial foothold, and then abuse widely-set capabilities with GTFObins. Initial foothold We start with an Nmap scan to get an idea of what we are working with: sudo nmap 10.129.40.196 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-19 07:08 EDT Nmap scan report for 10.129.40.196 Host is up (0.049s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds That’s interesting and not a whole lot of ports. Let’s do a more elaborate scan: …

A write-up of the HackTheBox machine “Eighteen”. This box revolves around turning application password hashes into an Active Directory foothold, then looks at the dMSA privilege-escalation path that Windows Server 2025 introduced. The host is a domain controller for eighteen.htb (DC01), and we are given one SQL Server login, kevin. Three TCP services are exposed: an IIS site on 80, SQL Server 2022 on 1433, and WinRM on 5985. DNS on 53/udp confirms the domain controller role. The path runs from the SQL login, through an application database and the password hashes stored in it, to a domain account reachable over WinRM, and from there toward a delegated managed service account (dMSA) escalation specific to Server 2025. …

A write-up of the HackTheBox machine “Certified”. This box revolves around a vulnerable certificate template that we can abuse to achieve Domain Admin privileges. The host is a domain controller for certified.htb, and we are handed one working account, judith.mader. The objective is the built-in Administrator. In outline the path runs from that account, through ownership of a group, to a service account, and finally to the certificate authority, where a misconfigured template lets us issue ourselves a certificate in the Administrator’s name. …

Most organisations now run at least one service built on a large language model (LLM), whether a customer-facing chatbot, an internal assistant, or a feature quietly embedded in a larger product. Each of these comes with a set of rules about what the model should and should not do. Jailbreaking is the practice of getting the model to break those rules. It helps to be clear about where the rules come from, because that decides how easily they give way. Some are trained into the model itself. A well-built model will decline to write malware or explain how to hurt someone even when nothing in its configuration tells it to refuse, because that behaviour was reinforced during training. Other rules are set at deployment time through a system prompt, the instructions an organisation gives the model before any user interacts with it: stay on the subject of our products, never discuss a competitor, do not give financial advice. The trained rules tend to be sturdier than the system-prompt rules, though neither is a hard boundary. Both can be worn down with the right input. …