Search
HTB: WingData Writeup | thepentesting.ninja

🔒 Protected Content

This post is password protected. Please enter the password to view the content.

Incorrect password. Please try again.

Connect With Me

HTB: WingData Writeup

HTB: WingData Writeup

thepentesting.ninja's Picture
thepentesting.ninja in wingdata htb hackthebox linux wingdata.htb

You may also like

HackTheBox: Administrator Writeup
12 min read

HackTheBox: Administrator Writeup

Medium Windows Active Directory box starting with given credentials. Exploit an ACL chain to pivot accounts, crack a PasswordSafe backup, and abuse GenericWrite to Kerberoast a DCSync-capable user.

thepentesting.ninja's Picture
thepentesting.ninja in administrator hackthebox windows active-directory acl-abuse kerberoasting dcsync passwordsafe
HackTheBox: Conversor Writeup
9 min read

HackTheBox: Conversor Writeup

Conversor is a medium Linux machine featuring XSLT injection via an EXSLT file-write primitive, credential harvesting from a SQLite database, and privilege escalation through a misconfigured needrestart sudo rule.

thepentesting.ninja's Picture
thepentesting.ninja in conversor hackthebox linux xslt-injection exslt sqlite needrestart sudo-abuse
HackTheBox: Trick Writeup
12 min read

HackTheBox: Trick Writeup

Trick is an easy Linux machine on HackTheBox combining DNS zone transfer enumeration, SQL injection, local file inclusion, and SMTP mail poisoning for foothold, then abusing a writable fail2ban action directory to escalate to root.

thepentesting.ninja's Picture
thepentesting.ninja in trick hackthebox linux dns sqli lfi smtp fail2ban

Latest Posts

HackTheBox: Administrator Writeup
12 min read

HackTheBox: Administrator Writeup

thepentesting.ninja's Picture
thepentesting.ninja
HackTheBox: Conversor Writeup
9 min read

HackTheBox: Conversor Writeup

thepentesting.ninja's Picture
thepentesting.ninja

Explore Tags

acl-abuse active-directory adcs administrator ai api apisec atlantis authentication-bypass bscp burpsuite capenx cbbh certifications charcol citycouncil codeparttwo command-injection conversor crushftp cspt ctf cve-2019-12840 cve-2024-4577 cve-2024-5932 cve-2025-31161 cve-2026-29000 cwes dcsync dns docker dom-poisoning dpapi easy erlang exception expressway exslt fail2ban gavel git-exposure gitea gitoops giveback hacksmarter hackthebox htb ike isakmp john js2py jwt kerberoasting kerberos kubernetes lfi linux medium mssql needrestart nosql-injection npbackup ntds ntlm-reflection ntlm-relay ntlm-theft offsec oscp pac4j password-cracking passwordsafe pentesting php portswigger postman principal privilege-escalation psk-cracking rce redis restore-ad-object review runc s3 sandbox-escape seimpersonateprivilege signed smtp soulmate sql-injection sqli sqlite ssh ssh-certificate ssrf sudo-abuse sudo-privesc suid terraform trick unicode-bypass upctf2026 voleur web webapp webmin welcome whoami windows writespn writeup xslt-injection xss xstf