Search
HTB: VariaType Writeup | thepentesting.ninja

🔒 Protected Content

This post is password protected. Please enter the password to view the content.

Incorrect password. Please try again.

Connect With Me

HTB: VariaType Writeup

HTB: VariaType Writeup

thepentesting.ninja's Picture
thepentesting.ninja in variatype htb hackthebox linux variatype.htb

You may also like

HTB: Redelegate Writeup
19 min read

HTB: Redelegate Writeup

Hard Windows Active Directory box involving FTP enumeration, KeePass cracking, MSSQL credential abuse, ForceChangePassword ACL exploitation, and constrained delegation abuse to achieve DCSync.

thepentesting.ninja's Picture
thepentesting.ninja in redelegate htb windows active-directory kerberos constrained-delegation mssql keepass
HackSmarter: Samurai Writeup
7 min read

HackSmarter: Samurai Writeup

Samurai is a Linux machine featuring a Joomla 4.2.5 instance vulnerable to CVE-2023-23752, leaking database credentials and sensitive information granting admin access, leading to RCE and a command injection privesc via a SUID-like custom binary.

thepentesting.ninja's Picture
thepentesting.ninja in samurai hacksmarter linux joomla cve-2023-23752 command-injection sudo rce
HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

EscapeTwo is an easy Windows Active Directory machine on HackTheBox. Starting with provided credentials, we enumerate SMB shares to recover plaintext credentials from Excel files, pivot through MSSQL to a shell as sql_svc, recover ryan credentials from a SQL installer config, then abuse ESC4 via the ca_svc account to forge an administrator certificate and own the domain.

thepentesting.ninja's Picture
thepentesting.ninja in escapetwo hackthebox windows active-directory mssql adcs esc4 kerberoasting smb

Latest Posts

HackSmarter: Martini Writeup
12 min read

HackSmarter: Martini Writeup

thepentesting.ninja's Picture
thepentesting.ninja
HackSmarter: ShadowGate Writeup
14 min read

HackSmarter: ShadowGate Writeup

thepentesting.ninja's Picture
thepentesting.ninja

Explore Tags

acl-abuse active-directory adcs administrator ai ansible-vault api apisec asreproasting atlantis authentication-bypass authority badsuccessor bash-injection bloodhound browsed bscp burpsuite bytecode-poisoning capenx cbbh certifications charcol citycouncil codeparttwo command-injection constrained-delegation conversor craft crushftp cspt ctf cve cve-2019-12840 cve-2023-23752 cve-2024-30088 cve-2024-4577 cve-2024-5932 cve-2025-31161 cve-2026-29000 cwes darkzero dcsync dns docker dom-poisoning dpapi easy eighteen erlang esc1 esc4 esc8 escapetwo eval-injection