https://maxisfront.me/tags/gtfobins/ Recent content in GTFOBins on MaxisFront Hugo en Sat, 11 Jul 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-facts-htb/ Sat, 11 Jul 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-facts-htb/ <blockquote> <p>All rights reserved by <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploiting the <code>CVE-2025-2304</code> on <code>CMS Camaleon 2.9.0</code> to escalate privileges through mass attribute assignment</li> <li>Obtaining <code>API Key</code> and <code>Secret Key</code> via the compromised <code>CMS</code></li> <li>Accessing the internal <code>bucket S3</code> via <code>minio-client</code>, discovering the private key <code>SSH</code></li> <li>Exploiting a <code>Path Traversal</code> (<code>CVE-2024-46987</code>) to read sensitive system files</li> <li>Privilege escalation using the <code>facter</code> binary with <code>sudo</code> permissions</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port and service enumeration</li> <li>Directory and web architecture enumeration</li> <li>Exploitation of vulnerabilities in <code>CMS</code> (Mass Attribute Assignment)</li> <li>Interaction with object storage services (<code>S3</code>) via <code>minio-client</code></li> <li>Exploitation of binaries with <code>sudo</code> permissions</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>ping</li> <li>nmap</li> <li>minio-client</li> <li>python3</li> <li>ssh2john</li> <li>john</li> <li>curl</li> <li>ssh</li> <li>facter</li> </ul> <hr> <h2 id="vulnerability-assesment-and-analysis">Vulnerability Assesment and Analysis</h2> <p>The <code>HTB</code> platform provides us with the target <code>IP</code>, which is <code>10.129.16.176</code>—an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p> https://maxisfront.me/posts/writeup-conversor-htb/ Sun, 24 May 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-conversor-htb/ <blockquote> <p>All rights reserved to <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploitation of <code>Path Traversal</code> to gain <code>RCE</code></li> <li>Extraction and cracking of hashes <code>MD5</code> via <code>Hashcat</code></li> <li>Reuse of credentials for access via <code>SSH</code></li> <li>Exploitation of the command&rsquo;s SUID <code>needrestart</code> (<code>CVE-2024-48990</code>)</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port enumeration</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation via UFU and RCE</li> <li>Searching for and using Critical CVEs</li> <li>Exploitation of vulnerable SUID</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>Nmap</li> <li>Caido</li> <li>Netcat</li> <li>Strings</li> <li>Hashcat</li> <li>SSH</li> <li>sudo</li> <li>needrestart</li> </ul> <hr> <h2 id="vulnerability-assessment-and-analysis">Vulnerability Assessment and Analysis</h2> <p>The platform <code>HTB</code> provides us with the <code>IP</code> target, which is the <code>10.129.12.212</code>, an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p>