https://solvere.app/tags/htb/ Recent content in Htb on Solvere Labs en-us contact@solvere.app (Solvere Labs) contact@solvere.app (Solvere Labs) © 2026 Solvere Labs Tue, 07 Apr 2026 00:00:00 +0000 https://solvere.app/icon-512.png https://solvere.app/tags/htb/ https://solvere.app/ctfs/htb/variatype/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/variatype/ The portal subdomain hosts a PHP Validation Dashboard. A .git directory was exposed at the root, allowing full source code recovery including deleted content from commit history. https://solvere.app/ctfs/htb/solidstate/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/solidstate/ print("[+]Done! Payload will be executed once somebody logs in."). https://solvere.app/ctfs/htb/sea/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/sea/ The exploits points the payload to the author's one on the file exploit.py, on line:. https://solvere.app/ctfs/htb/poison/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/poison/ On port 8000 the webserver running is serving the user.txt flag, maybe is another user who brought up the server to hack it???? https://solvere.app/ctfs/htb/nibbles/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/nibbles/ There is a login page on admin.php. https://solvere.app/ctfs/htb/interpreter/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/interpreter/ The target appears to have executed the payload. https://solvere.app/ctfs/htb/frolic/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/frolic/ Why this worked: The developer left credentials hardcoded in client-side JavaScript, validated entirely in the browser. No server-side auth — the JS just checks if input matches an https://solvere.app/ctfs/htb/friendzone/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/friendzone/ Development share — write access confirmed:. https://solvere.app/ctfs/htb/forest/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/forest/ RPC null session — user enumeration:. https://solvere.app/ctfs/htb/fluffy/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/fluffy/ crackmapexec smb 10.10.11.69 -u 'j.fleischman' -p 'J0elTHEM4n1990!' --shares. https://solvere.app/ctfs/htb/facts/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/facts/ Facts - an easy HackTheBox walkthrough with full steps and screenshots. https://solvere.app/ctfs/htb/eighteen/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/eighteen/ nxc mssql DC01.eighteen.htb -u kevin -p 'iNa2we6haRj2gaw!' --local-auth --rid-brute. https://solvere.app/ctfs/htb/devel/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/devel/ Step 3 — Start listener and trigger:. https://solvere.app/ctfs/htb/delivery/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/delivery/ Step 3 — Retrieve verification link from ticket:. https://solvere.app/ctfs/htb/cap/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/cap/ FTP transmits credentials in cleartext, exposing valid system credentials. https://solvere.app/ctfs/htb/bounty/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/bounty/ First attempt — upload .aspx webshell directly (naive approach):. https://solvere.app/ctfs/htb/blocky/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/blocky/ Blocky - an easy HackTheBox walkthrough with full steps and screenshots. https://solvere.app/ctfs/htb/beep/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/beep/ Beep - an easy HackTheBox walkthrough with full steps and screenshots. https://solvere.app/ctfs/htb/bastion/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/bastion/ mRemoteNG stores saved credentials in %APPDATA%\mRemoteNG\confCons.xml. https://solvere.app/ctfs/htb/bashed/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/bashed/ Site title: "Arrexel's Development Site" — hints at phpbash tool. https://solvere.app/ctfs/htb/armageddon/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/armageddon/ Attempt 1 — Malicious snap package with install hook:. https://solvere.app/ctfs/htb/active/ Tue, 07 Apr 2026 00:00:00 +0000 MountainFlayer htb https://solvere.app/ctfs/htb/active/ crackmapexec smb 10.129.5.161 -u '' -p '' --shares. https://solvere.app/ctfs/htb/artificial/ Tue, 28 Oct 2025 00:00:00 +0000 syselement htb https://solvere.app/ctfs/htb/artificial/ Impact: Full remote code execution (RCE). https://solvere.app/ctfs/htb/goodgames/ Sun, 06 Jul 2025 00:00:00 +0000 syselement htb https://solvere.app/ctfs/htb/goodgames/ Start BurpSuite and intercept traffic from browser via FoxyProxy. https://solvere.app/ctfs/htb/sau/ Tue, 01 Jul 2025 00:00:00 +0000 syselement htb https://solvere.app/ctfs/htb/sau/ The request-baskets project has been associated with a Server-Side Request Forgery (SSRF) vulnerability, specifically identified as CVE-2023-27163. https://solvere.app/ctfs/htb/spectra/ Sat, 07 Jun 2025 00:00:00 +0000 syselement htb https://solvere.app/ctfs/htb/spectra/ Host is up, received reset ttl 63 (0.035s latency). https://solvere.app/ctfs/htb/late/ Mon, 01 Aug 2022 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/late/ lsattr lists the file attributes on a second extended file system. See chattr below for a description of each attribute. https://solvere.app/ctfs/htb/catch/ Sat, 23 Jul 2022 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/catch/ If you want to decompile an Android APK application to see what files are inside run the following command:. https://solvere.app/ctfs/htb/acute/ Tue, 19 Jul 2022 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/acute/ Exiftool is highly useful for extracting metadata from documents extracted during enumeration. Leaking metadata can lead to compromise if it gets into the wrong hands, as it can ca https://solvere.app/ctfs/htb/attended/ Sun, 09 May 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/attended/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/sharp/ Sun, 02 May 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/sharp/ This hard-difficulty Windows machine from Hack the Box was both challenging and fun. As the name suggests, it focuses on a few user-made code projects that use the C Sharp programm https://solvere.app/ctfs/htb/bucket/ Sun, 25 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/bucket/ This medium difficulty Linux machine by MrR3boot on Hack the Box was very interesting and quite relevant in today's cloud-centric world. Many websites these days are hosted and run https://solvere.app/ctfs/htb/laboratory/ Mon, 19 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/laboratory/ This easy-difficulty Linux machine had an interesting take on a common use of a docker container. Installing a GitLab instance and storing sensitive code in it are likely uses that https://solvere.app/ctfs/htb/time/ Sat, 17 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/time/ This machine was almost dissapointingly easy for a medium box. It definitely should have been classified 'Easy'. A simple test at the beginning revealed a verbose error message. So https://solvere.app/ctfs/htb/resolute/ Sat, 17 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/resolute/ A medium-difficulty Windows box that was fairly straightforward. Privilege escalation required going through two different users and taking advantage of Windows domain group permis https://solvere.app/ctfs/htb/multimaster/ Sat, 17 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/multimaster/ Hold on to your seats, because this Insane Windows machine is a wild ride. TODO:Finish this writeup, there are more notes and stuff in the notes app if anything is missing... https://solvere.app/ctfs/htb/monteverde/ Sat, 17 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/monteverde/ Short description to include any strange things to be dealt with...when there is a proper description here the website build will stop breaking. Hopefully this is enough text to fi https://solvere.app/ctfs/htb/apt/ Sat, 17 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/apt/ This Windows insane-difficulty machine was quite challenging, but mostly due to its use of some unconventional settings. Breaking in involved many of the normal enumeration and pri https://solvere.app/ctfs/htb/luanne/ Sat, 03 Apr 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/luanne/ This easy difficulty BSD system...Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/reel2/ Fri, 26 Mar 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/reel2/ This machine was not as difficult in some respects as other Hard-difficulty machines, but the way that the machine was realistically hardened made it more challenging. The use of s https://solvere.app/ctfs/htb/crossfit/ Sun, 21 Mar 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/crossfit/ This Insane-difficulty machine from Hack The Box took far longer to root than I would have liked, mostly due to getting hung up on the the final exploit. I took a break from it, af https://solvere.app/ctfs/htb/jewel/ Sun, 21 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/jewel/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/doctor/ Sun, 21 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/doctor/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/worker/ Sat, 20 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/worker/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/feline/ Sat, 20 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/feline/ Short description to include any strange things to be dealt with - Hard Linux. https://solvere.app/ctfs/htb/compromised/ Sat, 20 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/compromised/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/unbalanced/ Fri, 19 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/unbalanced/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/omni/ Fri, 19 Feb 2021 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/omni/ Short description to include any strange things to be dealt with. https://solvere.app/ctfs/htb/laser/ Sun, 20 Dec 2020 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/laser/ This Insane-difficulty machine from Hack The Box took me a lot longer to progress to the initial foothold than most boxes take to root! This machine had some very interesting avenu https://solvere.app/ctfs/htb/openkeys/ Sun, 13 Dec 2020 00:00:00 +0000 zweilosec htb https://solvere.app/ctfs/htb/openkeys/ Short description to include any strange things to be dealt with.