Kebal Bhandari

Posts

Eloquia (Insane) HackTheBox Walkthrough

Eloquia (Insane) HackTheBox Walkthrough Eloquia is one of those boxes that reminds you why "Insane" difficulty exists. It is not a single clever trick. It is a chain of vulnerabilities where each one depends on the previous step. Miss a link, and you are stuck for hours. This post covers what the machine is about and the concepts it teaches, without walking through every keystroke. For the complete step by step exploitation guide with every command, payload, and screenshot, grab the CyberMaster Android app or visit my Buy Me a Coffee page. Machine Overview Field Detail Name Eloquia OS Windows Server 2019 Difficulty Insane Platform HackTheBox Services IIS 10.0 (HTTP), WinRM (5985) AD Standalone Windows Server, no AD What Makes Eloquia Interesting Eloquia is a modern enterprise simulation. It runs a custom Django blogging platform at eloquia.htb with ...

HTB : First Contact Writeup

This challenge is highly unique because it bypasses standard application bugs or privilege escalation vectors. Instead, it places you directly inside the virtual shoes of a ground station operator, requiring a clean mix of raw network script interaction and astronomical dataset propagation . The Anatomy of the Challenge Input When connecting to the live instance socket, you are instantly handed two distinct elements: Ground Station Telemetry: Precise floating point geographic variables representing the exact Latitude, Longitude, and elevation of a tracking array. Two-Line Element (TLE) Set: The industry standard data format mapping out the specific orbital elements of the target spacecraft, including inclination, eccentricity, and argument of perigee at a fixed point in time. The Technical Hurdle: Time W...

HTB Touch - Full Writeup (Easy Windows, Season 12)

Buy Me a Coffee Enjoying the writeup? Support the work. Season 12, Easy Windows. Finished it in an evening. Learned more than I expected. I finished the Touch machine on Hack The Box last night. It is rated Easy, and honestly, it earns that rating. There is no memory corruption, no exotic bug, no clever bypass that makes you feel like a wizard. What it has instead is a chain of small, believable mistakes that stack on top of each other until you are sitting on a SYSTEM shell wondering how you got there. That is why I wanted to write about it. Not because the box is hard, but because it is real. The Setup Touch is a Windows box themed around an airport. It picks up a thread from the earlier Layover machine, where you uncover a passenger name and a booking reference that you then reuse here. That small continuity detail is a nice touch, and it mirrors how real attackers actually operate. They rare...

Garfield (Hard, Active Directory) Walkthrough

Garfield is one of those rare HackTheBox machines where nothing is exploited with a CVE or a public proof of concept. Every step is a Microsoft documented Active Directory feature being abused exactly the way it was designed. That is what makes it a great box for anyone who wants to understand how real world Active Directory compromises actually look. The chain runs across seven distinct AD primitives, from a writable SYSVOL share to a forged Kerberos ticket against a Read Only Domain Controller. This post walks through the concepts behind each stage without dumping flags or hand holding every command. Why Garfield Is Interesting Most Active Directory boxes stop at Domain Admin. Garfield takes a different route. The writable Domain Controller on this box is a Read Only Domain Controller (RODC), and the RODC sits on a separate subnet that is not directly reachable from the attacker. That means the ch...

HTB Layover Discussion: From Open WiFi to Root

Layover is a Hack The Box Season 12 machine that rewards patience and careful enumeration. No single step in the chain is exotic. What makes it interesting is that each discovery depends on the previous one, and the overall path moves across three very different domains: wireless networking, web application security, and local Linux privilege escalation. This post is a discussion of the attack chain and the underlying weaknesses. Command-level detail and full reproduction steps are reserved for the detailed writeup, available through the link at the end of this post. Buy me a coffee Detailed writeup for supporters Overview of the Chain The compromise begins with access to a wireless-capable jump host. From that position, an internal wireless network is visible, and it is configured without any layer-2 encryption. A login submitted over plain HTTP o...

PingPong HTB Insane — Two Domain AD Forest Takeover

Overview: PingPong starts with a single low privileged account (c.roberts) in the PING.HTB domain and ends with full control of the forest. NTLM is disabled everywhere, so every step must run over Kerberos. The chain moves through ADCS abuse on PING, cross domain gMSA abuse into PONG, resource based constrained delegation and MSSQL for local admin on DC2, and finally back to PING via a CA Managers cross domain group to rewrite a certificate template (ESC4 to ESC1) and impersonate Administrator. Nmap The target is a Windows Domain Controller. Ports 53, 88, 135, 139, 389, 445, 464, 593, 636, 3268, 3269, and 5985 are open. The LDAP certificate SAN confirms the domain is ping.htb with hostname dc1.ping.htb . nmap -sC -sV -Pn <DC1_IP> -oN ./nmap.txt Add the hostname to /etc/hosts . The provided credentials are c.roberts / AssumedBreach123 . Information Gathering from DC1 SMB and LDAP both reject the supplied credentials with STATUS_NOT_SUPPORTED . That ...