0x5h4q

0x5h4q

PJPT

HTB

Top 6% THM

PicoCTF

Overthewire

Posts by Category

HackTheBox 13
Active Directory 11
Linux 5
TryHackMe 4
Concepts 3
VulnBank 2
Web Security 2
General 1
Web 1
Networking 1
Forensics 1
HackSmarter 1
Windows 1
Blue Team 1
Red Team 1
Pivoting 1

HackTheBox

HTB Cicada — Anonymous Share Leak, Guest RID-Brute & Backup Operators to Domain Admin

9 minute read

HTB TombWatcher — WriteSPN, gMSA Abuse, AD Recycle Bin & ESC15 to Domain Admin

5 minute read

HTB Orion — CraftCMS RCE, MySQL Credential Leak & Telnetd Auth Bypass

4 minute read

HTB FireFlow — Langflow RCE, JWT None Attack & Kubernetes Pod Escape

6 minute read

HTB Voleur — NTLM Disabled, Excel Blueprint, DPAPI & WSL NTDS Backup

7 minute read

HTB Administrator — ACL Chain Abuse, Password Safe & DCSync

5 minute read

HTB DevArea — CXF XXE, Hoverfly RCE & SysWatch Symlink Chain to Root

7 minute read

HTB WingData — Lua Injection RCE, Hash Cracking & Tar Symlink to Root

5 minute read

HTB Silentium — Flowise RCE, Docker Escape & Gogs Symlink to Root

7 minute read

HTB Fluffy — CVE-2025-24071, Shadow Credentials & ESC16 via AD CS

6 minute read

HTB Sauna — AS-REP Roasting, AutoLogon Credentials & DCSync

5 minute read

HTB Sauna

HTB Forest — AS-REP Roasting, BloodHound & DCSync via Exchange Permissions

5 minute read

HTB Forest

HTB Active — My First Real Active Directory Box

3 minute read

Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired

Back to Top ↑

Active Directory

HTB Cicada — Anonymous Share Leak, Guest RID-Brute & Backup Operators to Domain Admin

9 minute read

Certighost: How CVE-2026-54121 Turns a Domain User Into a Domain Controller

9 minute read

HTB TombWatcher — WriteSPN, gMSA Abuse, AD Recycle Bin & ESC15 to Domain Admin

5 minute read

HTB Voleur — NTLM Disabled, Excel Blueprint, DPAPI & WSL NTDS Backup

7 minute read

HTB Administrator — ACL Chain Abuse, Password Safe & DCSync

5 minute read

HTB Fluffy — CVE-2025-24071, Shadow Credentials & ESC16 via AD CS

6 minute read

HTB Sauna — AS-REP Roasting, AutoLogon Credentials & DCSync

5 minute read

HTB Sauna

THM Enterprise — Commit History, Kerberoasting & Unquoted Service Path to SYSTEM

9 minute read

THM Enterprise

HTB Forest — AS-REP Roasting, BloodHound & DCSync via Exchange Permissions

5 minute read

HTB Forest

THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets

5 minute read

THM VulnNet: Roasted

HTB Active — My First Real Active Directory Box

3 minute read

Difficulty: Easy OS: Windows IP: 10.129.34.50 Status: Retired

Back to Top ↑

Linux

HTB Orion — CraftCMS RCE, MySQL Credential Leak & Telnetd Auth Bypass

4 minute read

HTB FireFlow — Langflow RCE, JWT None Attack & Kubernetes Pod Escape

6 minute read

HTB DevArea — CXF XXE, Hoverfly RCE & SysWatch Symlink Chain to Root

7 minute read

HTB WingData — Lua Injection RCE, Hash Cracking & Tar Symlink to Root

5 minute read

HTB Silentium — Flowise RCE, Docker Escape & Gogs Symlink to Root

7 minute read

Back to Top ↑

TryHackMe

THM Wreath Pt.1 — Webmin RCE, Pivoting and a Relayed SYSTEM Shell

11 minute read

THM Enterprise — Commit History, Kerberoasting & Unquoted Service Path to SYSTEM

9 minute read

THM Enterprise

THM VulnNet: Roasted — AS-REP Roasting, Kerberoasting & SYSVOL Secrets

5 minute read

THM VulnNet: Roasted

THM ValenFind — LFI, Hardcoded Secrets & A Broken Heart(ed Database)

4 minute read

THM ValenFind

Back to Top ↑

Concepts

Certighost: How CVE-2026-54121 Turns a Domain User Into a Domain Controller

9 minute read

File Magic Bytes — Why You Can Never Trust a File Extension

8 minute read

Hiding In PL41N S1GHT

DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks

7 minute read

I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...

Back to Top ↑

VulnBank

VulnBank Series #2 — BOLA, Mass Assignment, Broken Transaction Logic & Weak Password Reset

10 minute read

VulnBank Series #1 — Recon, SQLi Auth Bypass & JWT Forgery

9 minute read

Back to Top ↑

Web Security

VulnBank Series #2 — BOLA, Mass Assignment, Broken Transaction Logic & Weak Password Reset

10 minute read

VulnBank Series #1 — Recon, SQLi Auth Bypass & JWT Forgery

9 minute read

Back to Top ↑

General

Hello World — Who is 0x5h4q?

less than 1 minute read

n0 pl4c3 l1k3 127.0.0.1

Back to Top ↑

Web

THM ValenFind — LFI, Hardcoded Secrets & A Broken Heart(ed Database)

4 minute read

THM ValenFind

Back to Top ↑

Networking

DNS Exfiltration — Stealing Data Through the One Protocol Nobody Blocks

7 minute read

I want to talk about one of my favourite “wait, that actually works?” attacks. Not favourite because it’s complex(quite the contrary really), favourite becau...

Back to Top ↑

Forensics

File Magic Bytes — Why You Can Never Trust a File Extension

8 minute read

Hiding In PL41N S1GHT

Back to Top ↑

HackSmarter

Attacking & Defending LSASS — Credential Dumping on Windows Server 2025

9 minute read

Back to Top ↑

Windows

Attacking & Defending LSASS — Credential Dumping on Windows Server 2025

9 minute read

Back to Top ↑

Blue Team

Attacking & Defending LSASS — Credential Dumping on Windows Server 2025

9 minute read

Back to Top ↑

Red Team

Certighost: How CVE-2026-54121 Turns a Domain User Into a Domain Controller

9 minute read

Back to Top ↑

Pivoting

THM Wreath Pt.1 — Webmin RCE, Pivoting and a Relayed SYSTEM Shell

11 minute read

Back to Top ↑