Easy

A write-up of the HackTheBox machine “Cap”. This box requires you to find a hidden pcap file to gain an initial foothold, and then abuse widely-set capabilities with GTFObins. Initial foothold We start with an Nmap scan to get an idea of what we are working with: sudo nmap 10.129.40.196 [sudo] password for kali: Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-19 07:08 EDT Nmap scan report for 10.129.40.196 Host is up (0.049s latency). Not shown: 997 closed tcp ports (reset) PORT STATE SERVICE 21/tcp open ftp 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.62 seconds That’s interesting and not a whole lot of ports. Let’s do a more elaborate scan: ...

A write-up of the HackTheBox machine “Eighteen”. This box revolves around turning application password hashes into an Active Directory foothold, then looks at the dMSA privilege-escalation path that Windows Server 2025 introduced. The host is a domain controller for eighteen.htb (DC01), and we are given one SQL Server login, kevin. Three TCP services are exposed: an IIS site on 80, SQL Server 2022 on 1433, and WinRM on 5985. DNS on 53/udp confirms the domain controller role. The path runs from the SQL login, through an application database and the password hashes stored in it, to a domain account reachable over WinRM, and from there toward a delegated managed service account (dMSA) escalation specific to Server 2025. ...