Search
HTB: VariaType Writeup | thepentesting.ninja

🔒 Protected Content

This post is password protected. Please enter the password to view the content.

Incorrect password. Please try again.

Connect With Me

HTB: VariaType Writeup

HTB: VariaType Writeup

thepentesting.ninja's Picture
thepentesting.ninja in variatype htb hackthebox linux variatype.htb

You may also like

HackSmarter: Samurai Writeup
7 min read

HackSmarter: Samurai Writeup

Samurai is a Linux machine featuring a Joomla 4.2.5 instance vulnerable to CVE-2023-23752, leaking database credentials and sensitive information granting admin access, leading to RCE and a command injection privesc via a SUID-like custom binary.

thepentesting.ninja's Picture
thepentesting.ninja in samurai hacksmarter linux joomla cve-2023-23752 command-injection sudo rce
HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

EscapeTwo is an easy Windows Active Directory machine on HackTheBox. Starting with provided credentials, we enumerate SMB shares to recover plaintext credentials from Excel files, pivot through MSSQL to a shell as sql_svc, recover ryan credentials from a SQL installer config, then abuse ESC4 via the ca_svc account to forge an administrator certificate and own the domain.

thepentesting.ninja's Picture
thepentesting.ninja in escapetwo hackthebox windows active-directory mssql adcs esc4 kerberoasting smb
HTB: Eighteen Writeup
13 min read

HTB: Eighteen Writeup

Eighteen is a Windows Server 2025 domain controller where MSSQL impersonation leads to a cracked PBKDF2 hash and a password spray foothold, then BadSuccessor dMSA abuse escalates to Domain Admin.

thepentesting.ninja's Picture
thepentesting.ninja in eighteen hackthebox windows mssql active-directory badsuccessor kerberos password-spray

Latest Posts

HackSmarter: Samurai Writeup
7 min read

HackSmarter: Samurai Writeup

thepentesting.ninja's Picture
thepentesting.ninja
HTB: EscapeTwo Writeup
15 min read

HTB: EscapeTwo Writeup

thepentesting.ninja's Picture
thepentesting.ninja

Explore Tags

acl-abuse active-directory adcs administrator ai ansible-vault api apisec atlantis authentication-bypass authority badsuccessor bash-injection bloodhound browsed bscp burpsuite bytecode-poisoning capenx cbbh certifications charcol citycouncil codeparttwo command-injection conversor craft crushftp cspt ctf cve-2019-12840 cve-2023-23752 cve-2024-30088 cve-2024-4577 cve-2024-5932 cve-2025-31161 cve-2026-29000 cwes darkzero dcsync dns docker dom-poisoning dpapi easy eighteen erlang esc1 esc4 esc8 escapetwo eval-injection exception expressway exslt