Archive
Browse case studies
Reviewed, evidence-based case studies from Hack The Box machines and Sherlocks, covering Windows, Linux, DFIR and SOC work where available. Search or filter by category and topic.
Case-study explorer
72 published case studies. Narrow by focus or keyword.
Showing 12 of 72Showing all 72 case studies
Principal
A Medium Linux Hack The Box machine where a pac4j-jwt JWE authentication bypass opens the dashboard, the exposed encryption key doubles as an SSH password, and a leaked SSH CA private key yields root.
htblinuxmachinejwt
HTB Sherlock: Holmes 2025 2: The Watchman's Residue
DFIR notes from a medium-difficulty Sherlock where a decommissioned host was used to prompt-inject an MSP helpdesk AI, then remotely access a workstation to dump credentials, add persistence, and exfiltrate files.
dfirsocwindowsthreat-hunting
EscapeTwo — AD CS ESC4 Template Abuse via WriteOwner and Shadow Credentials
A share readable by a low-privileged domain account exposes a live MSSQL sa credential, enabling command execution and configuration-file password reuse before AD CS ESC4 template abuse issues a certificate for the administrative identity.
windowsactive-directoryad-csmssql
Bashed — Exposed Web Shell and Root-Scheduled Script Abuse
Web enumeration exposes an interactive phpbash shell for www-data command execution, then a passwordless sudo transition and a writable root-scheduled script yield root.
linuxwebprivilege-escalation
Blocky — Exposed Plugin Credentials and Unrestricted Sudo
Web enumeration exposes a custom Java plugin; decompilation reveals hardcoded database credentials later reused for SSH, and an unrestricted sudo policy yields root.
linuxwebcredential-managementsudo
BoardLight — Dolibarr RCE and Enlightenment SUID Privilege Escalation
Virtual host enumeration reveals a Dolibarr CRM instance with default credentials; authenticated RCE, credential reuse, and an Enlightenment SUID flaw chain to root.
linuxwebdefault-credentialsprivilege-escalation
Broker — ActiveMQ OpenWire RCE and Unsafe Daemon Sudo
An Apache ActiveMQ deployment with a vulnerable OpenWire service and default console credentials yields a service-account shell; unrestricted nginx sudo enables a root file-write path.
linuxactivemqsudoconfiguration-security
Builder — Unauthenticated Jenkins CLI File Read to Root Credential Recovery
Unauthenticated Jenkins CLI file read (CVE-2024-23897) exposes a bcrypt password hash whose offline recovery unlocks the Script Console, and the credential store then reveals a path to root.
linuxjenkinsci-cdcredential-management
Busqueda — Searchor Expression Injection and Relative-Path Sudo Escalation
Unsafe evaluation in a Searchor search request yields command execution; exposed Git credentials, container environment inspection through sudo, and relative-path execution in a root script extend access.
linuxflaskcommand-injectiongitea
CCTV — ZoneMinder Blind SQL Injection to Root via motionEye Filename Command Injection
A blind SQL injection in ZoneMinder recovers credential hashes for SSH access, then filename command injection in a root-run motionEye service leads to root.
linuxsql-injectioncommand-injection
CozyHosting — Actuator Session Leak and sudo ssh ProxyCommand Escalation
A Spring Boot Actuator session leak grants admin access, and command injection in the SSH feature provides a foothold; credentials from the application JAR and an SSH ProxyCommand sudo rule lead to root.
linuxwebspring-bootcommand-injection
Craft — eval() Injection, Credential Reuse, and Vault SSH OTP
Leaked Gogs source exposes hardcoded API credentials and a Flask eval() call for container root; database credential reuse, a Gogs SSH key, and HashiCorp Vault SSH OTP then provide host root.
linuxwebcode-reviewcredential-reuse
Data — Grafana Path Traversal to Docker Container Escape
Grafana path traversal (CVE-2021-43798) extracts the application database for offline credential cracking, and a permissive docker exec sudo rule mounts the host filesystem to reach root.
linuxgrafanacvecontainer-escape
Editor — XWiki CVE-2025-24893 RCE to Netdata ndsudo PATH Hijack
XWiki SolrSearch unauthenticated Groovy code execution (CVE-2025-24893) provides a foothold; reused database credentials enable SSH, and a SUID Netdata ndsudo helper is hijacked through PATH to reach root.
linuxwebxwikicve
Editorial — SSRF and Git History Credential Leak to GitPython Command Injection
SSRF in a book-cover upload exposes an internal API and development credentials; Git history reveals production credentials, and a sudo-permitted GitPython script vulnerable to CVE-2022-24439 yields root.
linuxssrfgitpythoncredential-leak
Expressway — IKE Aggressive Mode to Sudo Hostname Bypass
IKE Aggressive Mode with PSK authentication exposes a crackable hash for SSH access, and a non-standard sudo binary is abused through a hostname-based policy bypass (CVE-2025-32462) to reach root.
linuxvpnikeprivilege-escalation
Helix — Unauthenticated NiFi RCE, a Recovered Operator Key, and OPC UA Maintenance-Window Root
Unauthenticated Apache NiFi command execution through CVE-2023-34468 and an H2 database driver, a recovered operator SSH key, and a cracked operations guide open an OPC UA maintenance window that grants root.
linuxapache-nificveopc-ua
Help — GraphQL Credential Leak to HelpDeskZ Upload RCE
A GraphQL endpoint leaks HelpDeskZ credentials and an attachment-upload weakness stores rejected PHP files under predictable names for web-service code execution; a kernel eBPF flaw (CVE-2017-16995) escalates to root.
linuxwebgraphqlhelpdeskz
Interpreter — Mirth Connect Unauthenticated RCE and Flask eval() Privilege Escalation
Mirth Connect XStream deserialization (CVE-2023-43208) provides an unauthenticated shell; database credentials and a PBKDF2 hash give SSH access, then a double eval() in a root-owned Flask service yields root.
linuxdeserializationcode-injectionhealthcare
Keeper — Default Credentials to KeePass Memory Disclosure
Default Request Tracker credentials and a password stored in a comment field provide user access; KeePass master-password recovery from a crash dump (CVE-2023-32784) unlocks an unencrypted root SSH key.
linuxdefault-credentialskeepasscve-2023-32784
Knife — PHP 8.1.0-dev Backdoor RCE and NOPASSWD knife Escalation
A backdoored PHP 8.1.0-dev build executes code through the User-Agentt header, and an unrestricted sudo rule for the Chef knife tool is abused via knife exec to reach root.
linuxsupply-chainsudophp
LinkVortex — Exposed Git History to Ghost CMS RCE and a Symlink-Protection Bypass
An exposed .git directory on a development virtual host reveals a CMS password for authenticated RCE; a sudo cleanup script with a user-controlled glob and a two-hop symlink chain reads a protected file.
linuxgitghost-cmssymlink
Magic — SQL Injection and Magic-Byte Upload Bypass to SUID PATH Hijack
SQL injection in a login page and PNG magic-byte upload evasion provide a foothold; MySQL credentials tunneled through Chisel and reused admin credentials enable lateral movement, and a SUID sysinfo binary is hijacked through PATH to reach root.
linuxwebsql-injectionprivilege-escalation
MonitorsFour — Cacti API Token Bypass to Privileged Docker Escape
An API access-control flaw exposes password hashes, and an unauthenticated Docker daemon allows a privileged container escape to host root.
linuxdockercactiapi
Networked — Web Shell Upload, Filename Command Injection, and sudo Network-Script Abuse
A leaked backup exposes upload source with weak MIME and extension checks, enabling a double-extension PHP web shell; command injection through filenames in a cron script and input validation gaps in a sudo network script lead to privileged access.
linuxcentoswebcommand-injection
Orion — Craft CMS Pre-Auth RCE and Loopback Telnet Authentication Bypass to Root
Craft CMS pre-authentication RCE (CVE-2025-32432) and plaintext database credentials lead to an administrator hash and SSH access; a GNU inetutils telnet authentication bypass (CVE-2026-24061) on loopback yields root.
linuxwebcmscredential-access
Outbound — Roundcube RCE, DES Session Decryption, and below Symlink Privilege Escalation
Authenticated Roundcube RCE (CVE-2025-49113) and session-table password decryption with the application DES key lead to SSH access; a symlink attack on the below utility's error log (CVE-2025-27591) yields root.
linuxwebroundcubecve
Pandora — SNMP Credential Leak to Pandora FMS Session Hijacking and SUID PATH Hijacking
SNMP enumeration leaks credentials for SSH access; an internal Pandora FMS instance reached through SSH dynamic forwarding is SQL-injected for session hijacking, and a SUID backup binary calling tar by relative name enables PATH hijacking to root.
linuxsnmpsql-injectionsuid
Ransom — PHP Type Juggling and ZipCrypto Known-Plaintext
A PHP loose-comparison flaw bypasses authentication; a ZIP archive's ZipCrypto encryption is broken via known-plaintext to recover an SSH key, and a hardcoded credential in Laravel source provides root.
linuxwebphplaravel
Sau — SSRF Chain to Maltrail Command Injection and Pager Escape
SSRF in request-baskets (CVE-2023-27163) reaches an internal Maltrail service vulnerable to command injection, and a NOPASSWD systemctl status rule is escalated through a less-pager escape (CVE-2023-26604) to root.
linuxssrfcommand-injectionrequest-baskets
Silentium — Flowise Token Disclosure and CustomMCP Code Injection to Root
A password-reset token returned in an API response, unsafe dynamic configuration evaluation in an AI-agent platform, and container secret exposure chain through an internal service to privileged access.
linuxwebflowiseai-platform
Snapped — Pre-Authentication Backup Disclosure and Encryption-Key Leak
Virtual host enumeration exposes an administrative interface and a pre-authentication backup disclosure that leaks AES key material; decrypting the application database recovers an SSH credential, and local enumeration identifies a privilege-escalation path.
linuxwebcvenginx
Soccer — Tiny File Manager Upload and dstat Plugin Privilege Escalation
Default credentials on exposed file-management software and an executable upload provide a web-service shell; WebSocket SQL injection recovers an SSH credential, and a doas rule for dstat is abused through plugin loading to reach root.
linuxwebwebsocketsql-injection
Strutted — Apache Struts Upload Path Traversal and tcpdump Sudo Hook
An exposed application archive identifies legacy Apache Struts upload handling, and CVE-2024-53677 path traversal yields a service-account shell; a stored credential enables SSH, and a sudo tcpdump post-rotate hook reaches root.
linuxapache-strutscve-2024-53677path-traversal
Titanic — Path Traversal to ImageMagick Shared-Library Hijacking
A download endpoint's path traversal exposes Gitea configuration and database data for password recovery and SSH access; an ImageMagick shared-library hijack (CVE-2024-41817) in a scheduled process provides elevated access.
linuxpath-traversalgiteaimagemagick
UpDown — Exposed Git Metadata, Upload Race, and Privileged Interpreter Abuse
Exposed version-control metadata and a custom-header development virtual host lead to an upload blocklist bypass and a race condition for a web-service shell; a SUID Python 2 input() helper and a package-installer sudo rule reach root.
linuxwebgitrace-condition
Usage — SQL Injection to Root via Laravel-admin Upload Bypass and 7-Zip Wildcard Abuse
SQL injection in a password-reset workflow and a Laravel-admin upload-validation bypass provide a foothold; reused Monit credentials enable SSH, and wildcard and @listfile handling in a sudo 7-Zip backup reach a protected root key.
linuxsql-injectionfile-uploadcredential-reuse
Wifinetic — Backup-Exposed Wi-Fi Key Reuse and a Default-PIN WPS Attack
Anonymous FTP exposes an OpenWrt backup containing a wireless key reused for SSH access; a raw-packet-capable reaver and a default WPS PIN recover a WPA key that grants root SSH.
linuxwifiwpscredential-reuse
WifineticTwo — OpenPLC RCE and WPS PixieDust Pivot
Default OpenPLC credentials and a Structured Text C extension provide container root; wireless scanning and a WPS PixieDust attack recover a WPA passphrase, and association leads to passwordless root SSH on a router.
linuxicswifiwps
Access — Credential Sprawl Across Legacy Services
Anonymous FTP and archive recovery expose credentials that grant Telnet access, then escalate through cached credential abuse.
windowscredential-abuselegacy-servicesftp
Administrator — ACL Abuse, Kerberoasting, and DCSync to Domain Compromise
Misconfigured object permissions drive a multi-hop chain through Kerberoasting, credential capture, and DCSync to domain compromise.
windowsactive-directorykerberoastingacl-abuse
Aero — ThemeBleed and CLFS Privilege Escalation
A malicious Windows theme upload on the ThemeBleed path yields a shell, then CLFS abuse escalates to SYSTEM.
windowscve-2023-38146cve-2023-28252themebleed
Authority — AD CS ESC1 via Ansible Vault Credential Exposure
An exposed Ansible vault and rogue LDAP listener expose service credentials, enabling ESC1 certificate abuse for Domain Administrator.
windowsactive-directoryad-csesc1
Breach — Kerberoasting and Unconstrained Delegation to Domain Administrator
A guest-readable logon script and excessive directory permissions lead through Kerberos delegation abuse to domain compromise.
windowsactive-directorykerberosdelegation
Cascade — Anonymous LDAP Disclosure and AD Recycle Bin Credential Recovery
Anonymous LDAP disclosure, SMB configuration artifacts, audit-app analysis, and AD Recycle Bin data combine into a credential-exposure chain.
windowsactive-directoryldap
Certified — Active Directory ACL Delegation and AD CS ESC9 Escalation
Group and account-control permissions form an ACL chain ending in AD CS ESC9 certificate abuse.
windowsactive-directoryad-cs
Cicada — Credential Chaining to Backup Operators Hive Extraction
Guest SMB, LDAP attributes, and embedded script credentials chain into Backup Operators hive extraction and domain compromise.
windowsactive-directorycredential-chaining
Delegate — Active Directory Unconstrained Delegation via NETLOGON Script Credentials
NETLOGON script credentials and GenericWrite over a delegation admin enable Kerberoasting, PetitPotam coercion, and DCSync.
windowsactive-directorykerberosdelegation
Eighteen — MSSQL Impersonation to badsuccessor Delegation and DCSync
A weakly secured MSSQL database yields cracked credentials, then badsuccessor OU delegation and DCSync complete domain compromise.
windowsactive-directorymssqlkerberos
Escape — AD CS ESC1 from Anonymous SMB and MSSQL Coercion
Anonymous SMB and MSSQL coercion recover credentials, then AD CS ESC1 certificate abuse yields the privileged account NT hash.
windowsactive-directoryad-csmssql
Fries — From a Gitea Credential Leak to ESC7 Domain Compromise
A provided Gitea login exposes database credentials that yield pgAdmin 4 remote code execution, Docker daemon control, captured domain credentials, and ESC7 certificate abuse on a dual-OS Active Directory lab.
windowsactive-directoryad-csdocker
Heist — Cisco Config Leak to Firefox Credential Extraction
A leaked Cisco configuration yields SMB and WinRM access, then Firefox process memory recovery exposes the Administrator password.
windowscredential-reuseprocess-dump
Intelligence — PDF Metadata to GMSA Silver Ticket via DNS Injection
PDF metadata and a default onboarding password enable DNS record injection and NTLM capture, then GMSA silver-ticket abuse reaches Domain Administrator.
windowsactive-directorypdf-metadatadns-injection
Jerry — Tomcat Manager Default Credentials to SYSTEM Shell
Default Tomcat Manager credentials allow WAR deployment, producing an immediate SYSTEM shell.
windowstomcatdefault-credentialswar-deployment
Logging — Log Leak, Shadow Credentials, and Rogue WSUS to SYSTEM
A log-file credential leak, Shadow Credentials abuse, and a rogue update server chain to SYSTEM code execution.
windowsactive-directoryad-csshadow-credentials
Mailing — Path Traversal, Outlook NTLM Coercion, and LibreOffice Privilege Escalation
A mail server path traversal exposes a configuration hash, and a crafted document triggers privileged code execution on a client host.
windowspath-traversalntlmcve-2024-21413
Manager — AD CS ESC7 via Certificate Authority Abuse
RID brute forcing, password spraying, and a legacy backup expose ManageCA rights, enabling the AD CS ESC7 abuse chain to domain compromise.
windowsactive-directoryad-csesc7
Monteverde — Azure AD Sync Credential Extraction
Guest SMB null authentication and a stored CliXml credential lead to Azure AD Sync database decryption and a domain administrator password.
windowsactive-directoryazure-ad-synccredential-theft
NanoCorp — NTLMv2 Capture, AD Delegation Abuse, and CheckMK MSI Repair Escalation
A zip-upload SSRF captures an NTLMv2 hash, and delegation abuse plus an MSI repair flaw create a domain administrator.
windowsactive-directoryntlm-captureresponder
Overwatch — ADIDNS Poisoning and WCF SOAP Command Injection
A monitoring binary leaks MSSQL credentials; ADIDNS poisoning captures more, and WCF command injection returns a SYSTEM shell.
windowsactive-directoryadidnsmssql
Pirate — gMSA Disclosure, NTLM-Relay RBCD, and SPN Abuse to Domain Controller
Kerberos clock-skew alignment, gMSA enumeration, and an NTLM relay pivot lead through delegation abuse to domain controller compromise.
windowsactive-directorykerberosgmsa
Resolute — LDAP Credential Exposure and DNSAdmins DLL Injection to SYSTEM
An LDAP description attribute and PowerShell transcripts expose administrative credentials, then DNSAdmins abuse loads a malicious DLL for SYSTEM.
windowsactive-directorycredential-exposurednsadmins
Retro — AD CS ESC1 Impersonation via Guest SMB Disclosure and a Pre-created Computer Account
Guest SMB notes and a pre-created computer account lead to an ESC1 certificate template and administrator impersonation.
windowsactive-directoryad-cs
Return — LDAP Credential Capture via Printer Admin Panel
A printer admin panel's LDAP configuration is redirected to capture service credentials, then Server Operators escalation reaches Administrator.
windowsactive-directoryldapcredential-capture
Scrambled — Weak Password Reset and Kerberos Ticket Forgery in Active Directory
A weak password reset enables Kerberoasting and silver-ticket forgery, then SeImpersonate abuse escalates to SYSTEM via GodPotato.
windowsactive-directorykerberossilver-ticket
Support — Embedded Credentials and RBCD Domain Compromise
Guest-accessible tooling, reversible credential obfuscation, and excessive computer-object permissions form a path to privileged access.
windowsactive-directorycredential-managementaccess-control
TheFrizz — Gibbon LMS RCE and a Group Policy Creator Owners Escalation Path
Gibbon LMS enumeration and database credential recovery lead to a Group Policy Creator Owners path toward Domain Administrator.
windowsactive-directoryweb
Timelapse — Certificate-Based WinRM Access and LAPS Password Disclosure
An SMB share exposes a protected certificate archive, and PowerShell history leaks a service account with LAPS read access.
windowsactive-directorycertificate-authenticationcredential-abuse
Voleur — Credential Chain to Offline Directory-Backup Abuse
Share-hosted documents, Kerberoasting, AD Recycle Bin recovery, and a WSL pivot lead into offline directory-backup analysis.
windowsactive-directorykerberosdpapi
Brutus — SSH Brute-Force, Interactive Root Access, and a Persistent Sudo Account
HTB Sherlock case study correlating authentication logs and session records to reconstruct an SSH brute-force, interactive root access, and a persistent sudo account.
dfirsoclinuxssh
LogJammer — Windows Event-Log Reconstruction of Interactive Access, Scheduled-Task Persistence, and Firewall Log Clearing
HTB Sherlock case study reconstructing a single-host Windows event-log timeline with Chainsaw: interactive logon, discovery-tool detection, audit-policy tampering, scheduled-task persistence, and Firewall log clearing.
dfirwindows-event-logsincident-response
Reaper — NTLM Relay Correlated from Packet Capture and Security Logs
Correlating a packet capture with Windows Security event logs to investigate a suspected NTLM relay and authenticated SMB share activity.
dfirwindowsntlmsmb
No case studies match. Clear a filter or broaden the search.