https://maxisfront.me/tags/web/ Recent content in Web on MaxisFront Hugo en Sun, 19 Jul 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-cctv-htb/ Sun, 19 Jul 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-cctv-htb/ <blockquote> <p>All rights reserved by <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploitation of default credentials on <code>ZoneMinder</code></li> <li>Exploitation of a boolean-based, time-based <code>SQLi</code> (<code>CVE-2024-51482</code>)</li> <li>Exploitation of <code>RCE</code> in <code>MotionEye</code> via a &ldquo;<code>client-side</code>&rdquo; bypass (<code>CVE-2025-60787</code>)</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port scanning</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation of <code>SQLi Boolean-based</code> and <code>time-based</code> using <code>SQLmap</code>.</li> <li>Cracking hashes using dictionary attacks.</li> <li>Bypassing client-side validations (<code>JavaScript</code>).</li> <li>Applying <code>Port Forwarding</code> via <code>SSH</code> to access internal services.</li> <li>Exploiting <code>RCE</code> in web applications.</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>ping</li> <li>nmap</li> <li>caido</li> <li>sqlmap</li> <li>hashcat</li> <li>ssh</li> <li>ss</li> <li>nc</li> </ul> <hr> <h2 id="vulnerability-assesment-and-analysis">Vulnerability Assesment and Analysis</h2> <p>The <code>HTB</code> platform provides us with the target <code>IP</code>, which is <code>10.129.47.195</code>—an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p> https://maxisfront.me/posts/writeup-facts-htb/ Sat, 11 Jul 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-facts-htb/ <blockquote> <p>All rights reserved by <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploiting the <code>CVE-2025-2304</code> on <code>CMS Camaleon 2.9.0</code> to escalate privileges through mass attribute assignment</li> <li>Obtaining <code>API Key</code> and <code>Secret Key</code> via the compromised <code>CMS</code></li> <li>Accessing the internal <code>bucket S3</code> via <code>minio-client</code>, discovering the private key <code>SSH</code></li> <li>Exploiting a <code>Path Traversal</code> (<code>CVE-2024-46987</code>) to read sensitive system files</li> <li>Privilege escalation using the <code>facter</code> binary with <code>sudo</code> permissions</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port and service enumeration</li> <li>Directory and web architecture enumeration</li> <li>Exploitation of vulnerabilities in <code>CMS</code> (Mass Attribute Assignment)</li> <li>Interaction with object storage services (<code>S3</code>) via <code>minio-client</code></li> <li>Exploitation of binaries with <code>sudo</code> permissions</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>ping</li> <li>nmap</li> <li>minio-client</li> <li>python3</li> <li>ssh2john</li> <li>john</li> <li>curl</li> <li>ssh</li> <li>facter</li> </ul> <hr> <h2 id="vulnerability-assesment-and-analysis">Vulnerability Assesment and Analysis</h2> <p>The <code>HTB</code> platform provides us with the target <code>IP</code>, which is <code>10.129.16.176</code>—an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p> https://maxisfront.me/posts/writeup-conversor-htb/ Sun, 24 May 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-conversor-htb/ <blockquote> <p>All rights reserved to <strong>Hack The Box LTD</strong>.</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Exploitation of <code>Path Traversal</code> to gain <code>RCE</code></li> <li>Extraction and cracking of hashes <code>MD5</code> via <code>Hashcat</code></li> <li>Reuse of credentials for access via <code>SSH</code></li> <li>Exploitation of the command&rsquo;s SUID <code>needrestart</code> (<code>CVE-2024-48990</code>)</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port enumeration</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation via UFU and RCE</li> <li>Searching for and using Critical CVEs</li> <li>Exploitation of vulnerable SUID</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>Nmap</li> <li>Caido</li> <li>Netcat</li> <li>Strings</li> <li>Hashcat</li> <li>SSH</li> <li>sudo</li> <li>needrestart</li> </ul> <hr> <h2 id="vulnerability-assessment-and-analysis">Vulnerability Assessment and Analysis</h2> <p>The platform <code>HTB</code> provides us with the <code>IP</code> target, which is the <code>10.129.12.212</code>, an address that can be reached by connecting through the <code>VPN</code> assigned to us by the platform.</p> https://maxisfront.me/posts/writeup-dc-2-vulnhub/ Wed, 25 Mar 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-dc-2-vulnhub/ <blockquote> <p>All rights reserved to the WordPress organization</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Listing users with <code>Caido</code></li> <li>Password discovery via <code>CeWL</code></li> <li>Reuse of credentials for the service <code>SSH</code></li> <li>Exploitation of the SUID bit on <code>git</code></li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port scanning and CMS enumeration</li> <li>Searching for and using critical CVEs</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation of vulnerable SUIDs</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>arp-scan</li> <li>Ping</li> <li>Nmap</li> <li>Caido</li> <li>WPScan</li> <li>CeWL</li> <li>SSH</li> <li>Git</li> </ul> <hr> <h2 id="vulnerability-assessment-and-analysis">Vulnerability Assessment and Analysis</h2> <p>First, we scan our local network using the <code>arp-scan</code>, specifying our network interface:</p> https://maxisfront.me/posts/writeup-dc-1-vulnhub/ Mon, 16 Mar 2026 00:00:00 +0000 https://maxisfront.me/posts/writeup-dc-1-vulnhub/ <blockquote> <p>All rights reserved by the Drupal organization</p> </blockquote> <div class="flash mb-3"> <blockquote> <p>Summary</p> </blockquote> <ul> <li>Service identification <code>Drupal 7</code> on port 80.</li> <li>Exploitation of the <code>CVE-2018-7600</code> to gain access (Drupalgeddon2).</li> <li>Exploiting SUID via the <code>find</code> to escalate to root.</li> <li>Security recommendations to prevent and mitigate vulnerabilities on this machine.</li> </ul> </div> <h4 id="skills-used">Skills Used</h4> <ul> <li>Port scanning and CMS enumeration</li> <li>Searching for and using critical CVEs</li> <li>Use of basic GNU/Linux-based commands</li> <li>Exploitation of vulnerable SUIDs</li> </ul> <h4 id="tools-used">Tools Used</h4> <ul> <li>arp-scan</li> <li>ping</li> <li>nmap</li> <li>python3</li> <li>nc</li> <li>find (SUID)</li> </ul> <hr> <h2 id="scanning-and-vulnerability-analysis">Scanning and Vulnerability Analysis</h2> <p>First, we analyzed our local network using the <code>arp-scan</code>, specifying our network interface. The command used was:</p>